Iowa State University
Chen, Qiming, "The probability, identification, and prevention of rare events in power systems " (2004).
Retrospective Theses and
Dissertations.
Paper 1149.
This Dissertation is brought to you for free and open access by Digital Repository @ Iowa State University. It has been accepted for inclusion in
Retrospective Theses and Dissertations by an authorized administrator of Digital Repository @ Iowa State University. For more information, please contact digirep@iastate.edu
.

by
A dissertation submitted to the graduate faculty in partial fulfillment of the requirements for the degree of
DOCTOR OF PHILOSOPHY
Major: Electrical Engineering (Electric Power)
Program of Study Committee:
James D. McCalley, Major Professor
Vijay Vittal
Arun K. Somani
Sunder Sethuraman
Nicola Elia
Iowa State University
Ames, Iowa
2004
Copyright © Qiming Chen, 2004. All rights reserved.

UMI Number: 3158321
Copyright 2004 by
Chen, Qiming
All rights reserved.
INFORMATION TO USERS
The quality of this reproduction is dependent upon the quality of the copy submitted. Broken or indistinct print, colored or poor quality illustrations and photographs, print bleed-through, substandard margins, and improper alignment can adversely affect reproduction.
In the unlikely event that the author did not send a complete manuscript and there are missing pages, these will be noted. Also, if unauthorized copyright material had to be removed, a note will indicate the deletion.
UMI
UMI Microform 3158321
Copyright 2005 by ProQuest Information and Learning Company.
All rights reserved. This microform edition is protected against unauthorized copying under Title 17, United States Code.
ProQuest Information and Learning Company
300 North Zeeb Road
P.O. Box 1346
Ann Arbor, Ml 48106-1346

ii
Graduate College
Iowa State University
This is to certify that the doctoral dissertation of
Qiming Chen has met the dissertation requirements of Iowa State University
Signature was redacted for privacy.
Signature was redacted for privacy.

iii
1.1 Review of Recent Catastrophic Events around the World
1.1.1 Characteristic of Cascading Failures in Power Systems
1.2 Approaches to Rare Events in General
1.2.1
1.2.2
Rare Event System and Rare Event Approximation
Event Tree Approach
1.3 Current Approaches to Rare Events in Power Systems
1.3.1
1.3.2
1.3.3
1.3.4
Contingency List Method
Special Protection Scheme (SPS)
Risk-based Security Assessment (RBSA)
Self-organized Criticality
1.4 Classification of Multiple Outage Contingencies
1.5 Types and Number of Initiating Contingencies
1.6 Organization of this Dissertation
2.1 Introduction
2.2 Background: Some Probability Models for Rare Events
2.2.1
2.2.2
2.2.3
Poisson Distribution
Negative Binomial Distribution
Power Law Distribution
2.3 Cluster Model for High-order Transmission Outages
2.3.1 Cluster Phenomenon and Multiple Contingencies in Power Systems
2.3.2 A Uniform Model for Poisson and Negative Binomial Distribution
2.3.3 Convergence Rate Comparison of Power Law and Cluster Distribution
2.4 Analysis of an IEEE Survey on High-order Initiating Contingencies
2.4.1 Maximum Likelihood Estimation
2.4.2 Estimating the Parameters Of Poisson Distribution
2.4.3 Estimating the Parameters of Cluster Model
2.4.4 Estimating the Parameters for Power Law Distribution
2.4.5 Comparing Cluster Model with Poisson and Power Law Model
2.5 Conclusion and Discussion
3.1 System Topology and Primary Multiple Contingencies
3 .2 Topological Identification of Primary High-order Contingencies
23
24
25
28
31
31
35
35
36
37
42
17
20
20
21
21
2
5
9
9
10
10
10
5
6
8
11
12
15
45
49

iv
3 .2.1 Graph Representations of Power System Topology with Substation Model
3.2.2 Some Anomalies in Functional Graph Decomposition
3.2.3 Algorithm to Searching for Topology for Contingencies
3.2.4 Test on a Large Utility Power System
3.3 Conclusion
4.1 Introduction to the Risk of Contingencies
4.2 Preparing Raw Reliability Data
4.3 Estimating the Risk of Typical Substations
4.3.1 Single Breaker and Single Bus (SB-SB)
4.3.2 Ring Bus
4.3.3 Single Bus Connected with Tie Breaker (SB-TL)
4.3.4 Double Breaker and Double Bus (DB-DB)
4.3.5
4.3.6
Breaker and a Half Bus (B-HB)
Summary
4.4 Estimating the Risk of IEEE RTS-79
4.4.1
4.4.2
4.4.3
4.4.4
Fault and Failure Probabilities of Power System Components
Initial Contingency List Generation
Estimating the Load to Be Shed
Risk Computation and Results Analysis
5.1 Dynamic Event Tree
5.2 Dynamic Event Tree Construction
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
Day-Ahead Forecasting System
Initiating Contingency Selection
Discretize Continuous State
Simulator
Action Selector
5.3 Tree Storage and Updating
5.4 Algorithm and Programming for DET Engine
5.4.1
5.4.2
5.4.3
Dynamics Simulation
Template DET and Amorphous DET
Use of Computing Resources
5.5 Using a DET
5.6 Discussion
5.6.1 DETandSPS
5.6.2 DET and Contingencies ListMethod
6.1 Description of the Test System
6.1.1 List of Test System Components and Parameters
6.1.2 Control Devices
6.2 Formulation of Dynamic Algebraic Equations
6.3 Description of Integration Method Used
6.4 Validation of the Dynamic Simulation Tool
6.5 DET Generation
73
73
74
76
77
78
79
81
82
83
84
86
86
92
49
58
60
69
71
98
101
104
105
106
107
108
108
108
109
110
110
Ill
112
113
113
115
116
116
118
120
122
124

V
6.5.1 Test Scenario
6.5.2 Contingency Event Branch
6.5.3 Decision Event Branch Set and Decision Identification
6.6 Results Analysis
7.1 Contributions of the Dissertation
7.2 Discussion and Future Work
124
125
126
126
130
131

VI
Figure 1.1 Event tree expansion following a line fault
Figure 2.1 Least square fitting Power Law to the statistics of line outages
9
23
Figure 2.2 Comparing uniform, random (independent), and cluster (clumped) patterns 24
Figure 2.3 Point process with/without clustering
Figure 2.4 Placing magnetic balls into 4 urns
24
26
Figure 2.5 Cluster distributions and actual frequency (linear scale)
Figure 2.6 Cluster distributions and actual frequency (semi-log scale)
Figure 2.7 Cluster distributions and actual frequency (log-log scale)
Figure 2.8 Contour and 3D plots of maximum likelihood for Cluster distribution (I)
Figure 2.9 Contour and 3D plots of maximum likelihood for Cluster distribution (II)
Figure 2.10 Plot of maximum likelihood function for Power Law
36
37
Figure 2.11 Semi-log and log-log plot of pdfs for Poisson, Power Law and Cluster model. 38
Figure 3.1 Lower order contingencies occupies the most probability space 44
30
30
30
36
Figure 3.2 N-3 Exposure increases from probability order 2 to 1
Figure 3.3 Double-breaker double-bus and single-bus-single-breaker
Figure 3.4 Double-breaker double-bus configuration with bus tie
Figure 3.5 Ring bus more vulnerable with the outage of one breaker
Figure 3.6 A graph with three vertices and three edges
Figure 3.7 One-line diagram of actual system illustrating functional groups
Figure 3.8 Two graph representation of Figure 3.7
Figure 3.9 Reduced functional group graph for Figure 3.8
Figure 3.10 Two breakers acting as backup of each other
Figure 3.11 Breaker B-2 connects one rather than two functional groups
Figure 3.12 A p-graph with a ring
Figure 4.1 Five typical substation configurations
Figure 4.2 Single breaker single bus substation and its B-matrix
50
51
51
55
47
48
48
49
58
59
60
75
76

vii
Figure 4.3 Ring bus substation and its B-matrix
Figure 4.4 Single bus connected with tie breaker and its ^-matrix
Figure 4.5 Double breaker and double bus and its ^-matrix
Figure 4.6 Breaker and a half bus and its B-matrix
Figure 4.7 Event tree to calculate the per-demand failure probability of a breaker
Figure 4.8 Example system for linear programming illustration
Figure 4.9 Average MW load shedding by contingency types
Figure 4.10 Expected MW load shedding by contingency types
Figure 4.11 Percentage load shedding by contingency types
Figure 5.1 A dynamic event tree representation of SPS design
Figure 5.2 Illustration of halting voltage collapse by dynamic event tree
Figure 5.3 A dynamic event tree illustration
Figure 5 .4 Dynamic event tree generation procedure
Figure 5.5 A simplified ideal dynamic event tree
Figure 5.6 A grand DET for one day time frame
Figure 5.7 Discretize operating condition by 24 equal time intervals and by equal load variance (weekday) 107
Figure 5.8 Discretize operating condition by 24 equal time intervals and by equal load variance (weekend day)
Figure 5.9 Complexity of DET in three dimensions
Figure 6.1 Governor block diagram of test system
Figure 6.2 Exciter block diagram of test system
Figure 6 .3 AGC block diagram of test system
Figure 6.4 Over-exciter limiter block diagram of test sytstem
Figure 6.5 ETMSP type 30 exciter for Ontario hydro 4-generator system
Figure 6.6 Response of generator after a temporary fault at bus section 5 (ETMSP)
Figure 6.7 Response of generator after a temporary fault at bus section 5 (DET engine)... 123
Figure 6.8 Dynamic event tree template for DET test system 124
117
118
122
123
107
112
116
117
Figure 6.9 System load ramp curve of DET test scenario
Figure 6.10 Branch loading after lost of the largest generator
125
128
85
90
93
94
95
78
79
80
81
99
100
100
101
102
104

viii
Figure 6.11 Line flow response after the lost of the largest generator
Figure 6.12 The DET scheme for the tripping of lines LI 06 & LI 16
Figure 6.13 Voltage response after the lost of the largest generator
Figure A.l Ontario hydro 4-generator system with test substation added
Figure B.l One line diagram of a DET test system
Figure D.l IEEE RTS-24 bus test system substation diagram
128
129
129
133
135
140

ix
Table 1.1 Summary of some large blackouts around the world 2
Table 2.1 High order transmission outages statistics 19
Table 2.2 Total number contingencies in each single or multiple contingency categories .19
Table 2.3 Facilitation-hindrance model with
A^t)
= (1 + a x /) A
0
(?) 25
Table 2.4 Parameters of different distribution models
Table 2.5 Comparing convergence rate with Cluster & Power Law pdf shapes
Table 2.6 Total accumulative number of contingencies in each single or multiple contingency categories
Table 2.7 Probabilities of contingencies according to estimated pdfs
Table 2.8 Grouping the sample space for /'-test
Table 2.9 y -test results summary
Table 3.1 Summary on disturbances caused by protection system failures
Table 3.2 List of vertex component of the power system diagram in Figure 3.7
Table 3.3 List of edge components for the power system diagram in Figure 3.7
Table 3.4 List of functional groups and identified their failure probabilities
28
29
Table 3.5 Connections for the interfacing components and the functional group
Table 3.6 Number of components in the utility system
Table 3.7 Number of functional groups
Table 3.8 Number of fault/breaker failure contingencies
Table 3.9 Search time to Identify contingencies 71
Table 4.1 The probability and risk of high-order contingency for different substations 83
Table 4.2 Summary of functional group contingencies for IEEE RTS96
Table 4.3 Summary of functional group contingency probabilities for IEEE RTS96
86
86
56
70
71
71
Table 4.4 Summary of fault/breaker failure contingencies for IEEE RTS96 86
Table 4.5 Summary of fault/breaker failure contingency probabilities for IEEE RTS96 86
45
53
54
54
31
38
40
41

X
Table 4.6 Summary of inadvertent tripping contingency probabilities for IEEE RTS96 86
Table 4.7 Solution for the sample LP problem in Figure 4.8 91
Table 4.8 Expected MW load shedding by contingency types
Table 4.9 The Expected MW load shedding by contingency types
93
94
Table 4.10 Expected contribution in percentage of total load shedding
Table 6.1 Initial status of generator for Ontario test system
Table 6.2 Identified contingency summary for test system
Table 6.3 Voltage problem summary by identified contingency for test system
Table A.l Bus sections and breaker connection data
95
122
125
127
133
Table A.2 Load and shunt data
Table A.3 Line data
Table A.4 Generator data
Table C.l Bus section and breaker data
Table C.2 Generator parameters
Table C.3 Transformer parameters
Table C.4 Line parameters for the test System
Table C.5 Load data
137
137
138
139
133
133
134
136

xi
Focfor
#/ec&owf
Evenf
CoMfmgency
An index for the tendency of power systems to have a cascading
A serious contingency that causes part or all of the system load to be disconnected
A chronological sequence of multiple lower-order dependent events
An unexpected event that cause the risk of system is higher that normal. In this paper we confine it to be a unplanned components) outage only.
Dynamic Algebraic Equations ZME
DET
EMS'
Evenf
FG f GC
FwncfzoMa/ Growp
Dynamic Event Tree
Energy Management System
Any occurrence that has a significant impact to a power system state. It may be a component outage, operational decision, load change, etc
Functional Group
Functional Group Contingency
A functional group is a group of components that operate and fail together due to their connection structure and protection scheme.
./fzAwzfzng CoMfiMgency The first contingency in a cascading event sequence. It may be a contingency as well as a #-7 contingency
7TC
MTTF
Inadvertent Tripping Contingency
Mean time to failure
MTZR
JVEKC
Mean time to repair
North American Reliability Council

xii
JV-& CoMfzMggncy f
A contingency that takes k major components out of service
Probability Density Function
Fai/wrg The conditional probability a component fails to perform the function when it is demanded or required as designed.
ProfecfzoM foz/wre The failure of a protection system, including relay system and circuit breakers, to perform the action as designed.
ARLfE
53C
.9C4D/4
SOC
SIRS'
SES"
Power Systems Engineering Research Center
Risk Based Security Analysis
Rapid Response to Unfolding Events
Stuck breaker contingency
Supervisory Control and Data Acquisition
Self-organized Criticality
System Protection Scheme/Special Protection Scheme
A set of system states that respond the same (equivalent) way to a specified event

1
A modem power system is normally reliable and robust to disturbances, even if the disturbance is large, i.e. the initiating contingencies are of high-order. This is due to the application of planning standards [1], the expansion of synchronized systems and the wide implementation of system wide controls such as system protection scheme (SPS) [2]. Power systems are expected to operate in a way that will not cause the denial of power supply to a large area under occurrence of any credible contingency. It is designed to be robust enough to withstand considerable disturbance at the planning stage. Each line, generator or transformer is armed with sophisticated and redundant protection schemes and monitoring devices.
Trained operators continuously monitor their condition. It should be unlikely for a power system to have an uncontrolled catastrophic event that blackouts a huge area. However, the behaviors of actual power systems around the world tell us a different story. The recent spate of large-scale blackouts in Europe and North America shows that what we did is not far from enough. Actually, large power system blackouts are not as rare as what the general public assumes. Reference [3] gives an exhaustive report on large power system blackouts in history worldwide. There are a number of questions power system engineers have to answer for these rare events, which are also called large blackouts, cascadings or catastrophic failures in different occasions. How 'rare' are such kinds of events? Can we predict them? What should we do if an event begins to unfold?
The objectives of this work are to
Provide a better understanding of the probabilities of rare events in power systems;
Develop ways to identify initiating high-order events in addition to contingencies;
-4» Provide an operational approach for avoiding or mitigating these types of events.
The focus of this work is on power system rare events that are not caused by uncontrollable natural forces. Large natural disasters like earthquakes, cyclones or

2 geomagnetic storms that cause simultaneous loss of much power equipment are not addressed in this work.
We list just a few representative catastrophic or could-be catastrophic events that have occurred in the past world wide in Table 1.1 and the paragraphs that follow. A detailed description of events can be found in Knight's book [3], NERC and PSERC's websites
[4][5], and the websites of each country that are responsible for reporting large power system disturbances. We describe a few of them in what follows.
Table 1.1 Summary of some large blackouts around the world
Location
US-NE [6]
New York [7]
France [8]
Japan [9]
US-West [4]
US-West [4]
US-West [4]
US-West [4]
US-West [4]
Brazil [10]
US [11]
London [12]
Denmark & Sweden ri3iri4i
Italy [15]
Date
10-11/9/65
7/13/77
1978
1987
1/17/94
12/14/94
7/2/96
7/3/96
8/10/96
3/11/99
8/14/03
8/28/03
9/23/03
9/28/03
Scale in term of MW or Population
20GW, 30M people
6GW, 9M people
29GW
8.2GW
7.5GW
9.3GW
11.7GW
1.2GW
30.5GW
25GW
62GW, 50M people
724 MW, 476K people
4.85M people
27.7GW, 57M people
Collapse time
13 mins
1 hour
26 mins
20mins
1 min
36 seconds
> 1 min
> 6 mins
30 sees
> 1 hour
8 sees
7mins
27mins
At 1:25 A.M. on December 14, 1994, electric power flowed much heavier than normal from southern California to northern California and from northern California to the
Northwest. A single phase-to-ground fault on a 345kv line at the three-terminal substation

3
Midpoint-Borah in Idaho caused the inadvertent tripping of an additional 345kv line in the same station. Due to the substation configuration, the remaining line became open-ended, which is equivalent to being off-line. Overload and under voltage condition for some lines developed within the system due to the weakened network. The lines tripped one after another in a domino effect style, which led to the formation of four separate islands. 5,020
MW power was lost and 1,500,000 customers affected in this single phase-to-ground fault initiated event [4].
At 1:25 P.M. on July 2, 1996, a huge disturbance occurred in WSCC system. A short circuit occurred on a 345 kv line between the Jim Bridger plant near Rock Springs and it was tripped successfully. This disturbance caused a parallel line to be tripped also. An SPS scheme was initiated after the tripping of the two lines, which shut down two generating units at the Jim Bridger plant. The under-voltage and inter-area oscillation problem developed quickly throughout the system. At least five islands were formed as a result. 2,500MW power was lost and 1,500,000 customers affected [4].
At 2:03 P.M. on July 3, 1996, a chain of initiating events that is very similar to the incidence, which occurred about the same time as the previous day in WSCC system began.
After the shutdown of two generating units at the Jim Bridger plant, similar voltage problem began to develop. However, the operators of Idaho Power Company, recognizing the potential for an incident similar to that of July 2, manually shed about 1,200 MW of demand in the Boise area. As a result of this decisive action, the system was saved and only a small number of customers were affected [4].
At 15:48 on August 10, 1996, high temperature throughout the West coast led to high electricity demands. A number of transmission line outages in Washington and Oregon over a period of about one hour weakened the transmission system, which led to growing voltage oscillations in the system. Three 500 kV Pacific AC tie lines and the +/- 500 kV Pacific DC tie-line were lost due to the oscillation, which rendered the system to a state of random outages without control. The result was that 5,700,000 customers were interrupted [4].

4
At 22:16 on March 11, 1999, a phase-to-ground fault struck the Bauru 440 kV bus bar that had no bus bar protection and breaker failure protection intalled. It caused the opening of all the five 440 kV lines connected to the station. The Brazil power system withstands the multiple intiating contingency, but only for 10 seconds. The power system began to collapse starting at the disconnection of T.Irmâos-I.Solteira 440 kV. A sequence of trippings of a number of power plants in the Sâo Paulo area, the loss of both the HVDC and the 750 kV AC links from Itaipu, finally led to the separation of the system. This disturbance caused the loss of 24,731 MW load. 75 million people were affected for up to four hours. About 10 islands were formed after the separartion [10].
Before the blackout, a sequence of line trippings in northeast Ohio after 15:05 EDT caused heavy loadings on a number transmission lines. The weaken system quickly started a cascading blackout at 16:05:57 (East Standard Time) after the Sammis-Star 345-kV relayed.
In less than ten minutes, more than 508 generating units at 265 power plants were lost. The northern part of the whole eastern interconnection was broken apart into five islands. The blackout affected about 50 million people and caused the loss of 61,800 megawatts of electric load in the states of Ohio, Michigan, Pennsylvania, New York, Vermont, Massachusetts,
Connecticut, New Jersey and the Canadian province of Ontario [11].
In the night of September 28 at 03:01:42, the 380kv transmission line Lavorgo - Mettlen connecting Italy and Switzerland had a flashover over a tree and was tripped by relay. This tripping caused some other transmission lines to become overloaded also. About 25 minutes later, two transmission lines, the 380kv Sils (Italy) - Soazza (Switzerland) and the 220kv
Airolo (Italy)-Mettlen (Switzerland), were also tripped due to overload. At 03:25:26, a special protection scheme automatically disconnected the 380kv Lienz (Austria) - Soverzene
(Italy) to protect the Austria system. Immediately after the last contingency, the Italian grid lost its synchronism and went separated. A total of 27.7GW load was lost and 57 million people were affected. The energy not delivered amounted to 180GWh [15].

5
It is observed that cascadings can happen no matter the system is heavily overloaded as in the case of the WSCC summer events or is lightly loaded as in the WSCC winter events.
System could collapse immediately after an initial contingency, which leaves little room for operator to take any action, as well as take a considerable time (minutes to hours) before final system wide collapse. When a system is stressed, a single fault tripping is more likely to trigger other events and thus a big blackout, while when a system is only lightly overloaded, a more severe triggering event is need to bring a cascading.
1.1.1 Characteristic of Cascading Failures in Power Systems
Since large scale power systems are usually interconnected, and each part depends on the proper function of other parts, even small disturbances can propagate like a ripple in water, bringing troubles to a wide area if the system is operating close to limits. As we may see from the events listed in the last section, they have the following common characteristics:
4- The initiating event may be as well as
Following the initiating contingency, additional outages occur one by one rather than simultaneously;
While in many cases systems are typically stressed with overloading, which means a minor contingency may be contagious and spark a system wide failure as in the
WSCC 1996 summer case, catastrophic events can also happen when the system load is very light in middle of night and in winter as in Italy 2003 and the WSCC 1994;
4- Initiating and subsequent causes are various. Protection malfunction, insufficient reactive power, and inappropriate relay setting can all contribute to a cascading blackout.
There are many approaches to evaluate the reliability of a system. The typical approaches include failure modes and effect analysis (FMEA), fault tree analysis (FTA), event tree, and state space method [16]-[17]. When the number of components is small or the system can be reduced to a small number of components, engineers can study the system reliability
' In the language of the power system engineer, if there are # functioning components then an event is the loss of one of them, and an N-k event is loss of k of them when it is implicit that k> 1.

6 thoroughly by enumerating the system's failure mode. As the scale of the system increases and there are strong inter-dependencies among the components of the system (as in a network), which makes it difficult to be reduced, engineers must seek other ways to study system reliability. Two ways to approach the reliability of a complex network are event tree based on rare event approximation and Monte Carlo simulation. The motivating idea of both these approaches is that if it is impossible to capture all of the failure modes of a complex system, then we should devise a method of identifying and studying important subsets of all failure modes.
The rest of this chapter will give two ideal probability models that model some interdependency between events in order to give a more accurate estimation of high-order contingencies.
1.2.1 Rare Event System and Rare Event Approximation
Usually for a well-maintained system, the probability of component in failure state is very small while the probability of component in normal state approaches 1 in a particular time interval, provided that the component is currently available.
If the failure probabilities of each component in an ideal reliability system are independent of each other, the probability of any event ,4; (;=7, 2, j...) of the system can always be expressed as the summation off}(f;, ..., P„) Each E) can be expressed as
F, (i.i) where P/, _?&... and P* are the failure probabilities of each component in the system.
We say that the event (z=7, 2, 3,...) is a system of rare events if there exist a such that f/, and approaches as p goes to zero, where C is a constant for
One important property of a rare event system is that when we calculate the probability of its events, we can always omit high order terms with little loss of accuracy. Its application includes event tree simplification when the studying the availability of f the complex systems.
Suppose py, are the individual probabilities of a group of independent events E/,
Ej, Ej. The probability of a compound event, i.e., a combination of events Ey, Ej, . .. E„, can always be expressed as a polynomial of jo,, For example, the probability of the

7 event (E;n ^2)^3 is f Further suppose that p,, -, are all of approximately the same order of magnitude, then the order of magnitude of each product term in the polynomial will depend on how many terms are in the product. We call the number of terms in the product the probability order. Thus, the probability of is composed of three different terms (probability order 1), pip% (probability order 2), and
(probability order 3).
The basic idea of rare event approximation is that, if the individual probabilities of a group of independent events are very small, we can always simplify the calculation by omitting the higher order terms of the polynomial without much loss of precision [18] . In the given example, if we knew that /%, and were very small, then the probability of (#7 m
E2)v&3 could be approximated as or even as
Often, the failure probability of an individual component is very small for a wellmanaged system such as a power system. The fault probability of a power system component is usually at the magnitude of 10"* per hour (or <1% per year) [19]. Suppose the fault probability of a line is per hour and the failure probability of a breaker is pz/hour.
Obviously, they are not exclusive events. The probability of a fault (py), breaker in a failed state (f%), or both can be expressed as assuming the two events are independent.
Considering the small nature of py and p%, if we ignore the probability component of simultaneous occurrence of the two events, the error is only about 10
Based on this idea, the sequence of our research should focus on the high order events with higher probability first, then lower probability, since, as the order of contingency increases, the probability of its occurrence decreases sharply to infinitesimal. A complete discussion of rare event systems can be found in [18].
Although not stated clearly, much of the literatures implicitly apply the rule of rare event approximation. We summarize the convention as
1. For contingencies with the same probability order, those that are likely to cause greater consequence are analyzed with higher priority. This rule explains the rationale for ranking all contingencies by their consequences.
2. For high order contingencies, their probabilities usually are assumed to be not at the same order of magnitude as single contingencies. Unless they are clearly of

8 higher probabilities or will cause a huge loss, they will not be analyzed and ranked, and therefore no money is spent in trying to prevent their occurrences or mitigating their consequences.
Although rare event approximation provides a convenient way to estimate probability, it has severe disadvantages. It does not consider interdependence between the occurrences of events. A line trip is more likely following an initial line trip, that is, the second event is dependent on the previous events. In addition, some high order contingencies may occur with probability equivalent or even higher than a common contingency because of topological weakness. This will be discussed in Chapter 3.
1.2.2 Event Tree Approach
For a small system with limited components, it is possible to study all its fault modes and study them one by one in detail. However, for a large system, a system wide failure is often due to chronological sequence of events, with the occurrence of a next event depending on occurrence of previous events. It is useful to model these events with an event tree. There is no strict definition for an event tree, but we can understand it by the following characteristics.
4- Event trees are horizontally built treelike structures that begin on the roots, i.e. the initiating events;
Development of an event tree from the root proceeds chronologically;
Each path from root to end nodes of an event tree represents a sequence or scenario with associated consequence;
-4- An event tree is most useful if the condition of a system depends on an approximately chronological, but discrete, operation of its units or subsystems.
The correct or incorrect function of one part of protection often depends on the function of another part. The action of protection system, whether successful or not, often happens in a sequence rather than simultaneously. This characteristic makes the event tree [16] and [18] a suitable tool to model the protection failure scenario. Figure 1.1 shows a conceptual event tree describing the protection behavior of a power system after an initiating fault event.
This tree is not expanded to a full scale. It is the useful feature of the event tree that it can be pruned according to the structure of the physical system or the probability of events.
Should the tree be fully expanded, there would be eight branches on the right side of the event

9 tree rather than four. Other possible branches of the tree are cut off. For example, if there is a fault but the primary protection system (relay) fails, breaker failure has no influence on the outcome. We assume breaker failure, relay failure, and inadvertent tripping are independent events with small probability. The right side of the diagram provides the probabilities and descriptions of each event sequence. The probabilities of each node are approximated by the rare event approximation, i.e., we use 7 to substitute those 7-p, terms. The three types of #-
7/7V-& primary confrnggncies described in section 1.6 are actually three branches of the event tree in Figure 3.1 below.
s p&)-*
L~
Ik
«r
2s.
Is °
P(B/A)=l-p
2
P(C/A,B)=1
-P3
<
P(D/A,B,C)=1
-P4
P(D c
/ A , B , C
)=P4 <
PP^,B)-P3
P(B
C
/A)=p
2
"p
P<si)=pl
Pr(S2)~plp4
Pr(S3)«=plp3
Pr(S4)%plp2
Figure 1.1 Event tree expansion following a line fault
1.3.1 Contingency List Method
With limit computing resources, it is necessary to limit the number of contingencies to be studied. A common practice in power industries is to rank the contingencies according to their importance and then select the most import ones to study in detail. To rank the contingencies, a performance index is defined, usually in the form of
= Zw,(x,)|/(%,)|" where x, is a post-contingency performance measure, / is a function that gives the consequence measure of the contingency, and wy is the weighting function for [20]-[22].

10
1.3.2 Special Protection Scheme fSPSl
SPS used to be an acronym for <$Decia/ frofecfion but now it stands for jfysfem frofecfion ^cAeme (since all protection system may be considered special in some sense).
According to [2], &P5" w (désigna/ fo defect a6»ormaZ ay^fem comdifioMf ond fa&e pref/eferming^ corrective ocfiow (bfAer fAan fAe iaoWion q/}!zw/fe(/ e/emen^ fo preserve fAe mfegrzfy oW provide acc^pfa6/e jy^fem pey/brTMance.
There are two types of SPS: event-based and response-based. Event based SPS is triggered by selected rare contingencies, for which the power system is not designed.
Response-based SPS take measured electric variables such as frequency or voltage as its triggering signal. The corrective actions taken by SPS include remote load shedding, automatic shunt switching, braking resister, controlled opening of interconnection, tap changer blocking and set-point adjustment.
1.3.3 Risk-based Security Assessment fRBSA)
Risk-based security assessment of power systems was first proposed in [23]. Since then a number of papers [23]-[36] has been published regarding this topic. The risk index, which is defined to be the expected consequence, calculated by RBSA provides a good indication of how robust a system is and by sensitivity analysis, it identifies ways to mitigate high risk. A review on this issue can be found in [33].
13.4 Self-nreanlzed Crltirality
The concept of Self-Organized Critically (SOC) was first proposed in Dr. Bak's paper
[41] and his book [46]. The theory provides a new view of nature. The main point of this theory is that nature is always unbalanced and organized in a critical state. The statistics of state follow a 'Power Law', which means the probability (P) of event (s) is some power of the scale (or the rarity) of the event. That means every event, no matter how rare it is and at what scale, can happen with a probability higher than people used to assume. The theory tries to give us insight that even if the rule that governs a system is simple, the behavior of the system may be complex. Dr. Bak claims that SOC has been found in many areas, which includes landscape formations, earthquakes, solar flares, and biological evolutions.

11
There is also some papers that discuss the application of SOC in power systems [42] [43] by Dobson. These papers claim to find initial evidence based on statistics from the North
American Reliability Council (NERC) that power systems follows SOC rule.
As introduced in [5], Self-Organized Criticality provides new ways of thinking about the reliability of complex systems. Because of the interdependence of the components of complex systems, small disturbances to the system can trigger a domino effect. Power system engineers studying major contingencies look for specific reasons behind each event. Each contingency is unique and needs to be studied on individual bases. However, if we study them from a statistical point of view, we can make some useful high-level observations. The surprising part of this theory is that it claims a system with SOC is inherently unreliable and catastrophic events are inevitable.
Identification of high-risk #-& contingencies involves two basic steps: selection of JV-t contingencies and network performance assessment for those contingencies.
In this section, we provide the basic reasoning used in our approach to the first step.
Four distinct types of #-& contingencies have been identified that have high probability relative to other contingencies. They are classified according to circumstances under which they arise. These are:
Type 1 : protection system inadvertent operation;
Type 2: protection system failure to operate when needed;
Type 3: topological vulnerability;
-4- Type 4: cascading.
Major blackouts are typically low probability, high consequence events, or rare events.
Their causes are various. We classify events into one of two classes based on their likelihood.
#-7 events: These are often called "credible" events, and they form the basis of traditional security assessment. They result in loss of a single power system component, such as a line, transformer, or generator. Although AW events range in probability, this range will typically not be more than one order magnitude.

12
Therefore, we say that all AW events have probability order P. For this category, it is the task of the local protection to remove the problematic element.
JV-t events: Here, it is implicit that *>/, indicating an A^& event may be loss of 2 or more power system components. These events, otherwise known as "high-order" events, are often of lower probability than AW events. They can in turn be divided into two sub-classes:
- Independent A^& events: These are typically very rare; they will have probability order of P*, where P is the probability of a single outage and AT is the number of outaged components. However, when there is a common cause that could lead to events, their probability can be higher.
- Dependent A^t events: These are typically not rare; they will have probability order p ranging from P*<p<P.
We put our effort mainly on type 2 and type 3 in this dissertation.
The causes of cascading events in power systems are various. One major contribution to cascading is higher order initiating contingencies—simultaneous removal of several power system components in a very short (typically in seconds) time. Contingency set identification is an essential step in monitoring the power system security level. Currently, most literature
[20] on contingency selection emphasizes the screening method to select contingencies from a presumed AT-7 contingency set plus a limited number of high order contingencies, ranking them using an appropriate severity index. References [37]-[39] studied the effect of the multiple outage caused by substation and protection failure for individual substations.
However, the literature on systematic selection of high order contingencies, called Af—t contingencies with is limited. The difficulty of Af-& contingency selection lies in the combinatorial nature of their number: the total number of distinct non-ordered (simultaneous)
AT-& contingencies is AW[&7(3V-%)]. For a very modest size power system model with
N-1000, there are 499,500 Af-2 contingencies, 166,167,000 N-3 contingencies, over 41 billion AT-V contingencies, and so on. One might argue that most of these contingencies are so low in probability that they do not warrant attention. However, A/-&, contingencies

13 do occur, and when they do, consequences can be very severe, and these very practical facts motivate the identiGcation of high-order contingencies that cause high risk.
As the multiple primary contingencies analysis problem is formidable because of its combinatorial nature, we are interested in whether the rare event approximation has a significant effect on decreasing the number of events worth investigating. We use the probability order two ( ) as a criteria for our cutoff. By this criterion, given a fault, we assume only one breaker could suffer a stuck failure, and only one neighboring component could suffer inadvertent tripping. This assumption is consistent with the rare event approximation. We are not going to do anything to list the primary contingencies with probability order greater than 2; further more, we will not study all the contingencies within the cutoff, rather we will select a subset of them based on observation of published contingencies statistics [40][4].
For modem large-scale power systems, the initial loss of one or more components
(typically transmission lines) usually does not cause an immediate collapse. It is the slow dynamics following the tripping that eventually causes the widespread outage. We do the dynamic system simulation assuming the failed component is removed immediately. We capture the main problem this way without jeopardizing too much accuracy of our analysis.
Three types of contingencies addressed in this dissertation are:
1) FGC: Functional group tripping contingencies
This category of contingencies includes all the forced outages due to primary protection tripping caused by whatever reason. The tripping action may be proper or inadvertent. We distinguish FGC by the components it removes rather than the cause of the contingencies. An FGC is usually an AW event. It also could be an 7V-&, k>l contingency, depending on the amount of components within the functional group. The contingency in this category happens with a probability order greater than one.
2) SBC Stuck breaker tripping contingencies following FGC contingencies
This category of contingencies includes all the forced outages due to primary protection tripping caused by fault plus failure of one breaker to open. It is

14 usually a multiple contingency outage. The contingency in this category happens with a probability order of two.
3) ITC Protection relay inadvertent tripping contingencies following FGC.
This category of contingencies includes all the forced outages due to primary protection tripping plus an additional line tripping nearby. It is usually a multiple component outage. The contingency in this category happens with a probability order of two.
These contingency categories capture the majority of high-order contingencies that can be systematically identified by topology processing. There are other types of contingencies with higher probability but unique to specific systems, such as common right-of-way and common tower lines. They can be studied on individual basis. This dissertation does not address them.
The number of events we study may be calculated by
N = N fgc
+ N
SBC
+ N
JTC where A^^ is the total number of contingencies by protection failure to trip,
(1.2) is the total number of contingencies due to breaker failure to trip after fault, and A^ is the total number of contingencies due to inadvertent tripping.
Actually the total number of contingencies # is roughly linearly proportional to the number of functional groups (denoted as Z below) multiplied by the average number of breakers that can isolate the functional groups. The total number of contingencies is bounded by F x (max {AT^}+max {A^ )+1), as we may see from the inequality below.
N = N
F G C
+ N
S B C
+ NFJÇ, i ~ \ where A%; is the number of neighboring lines for functional group i, A/B, is the number of breakers needed to open to isolate functional group i, AfD, equals 1 if there is differential protection for zone i and 0 if not. If a breaker fails to operate, then either the relay fails to detect the fault or breaker itself suffers an actuating mechanism failure. So, A3, includes the two cases as both result in the operation of backup protection and subsequent outage of one or more additional elements. That is why AfD, is an indicator function of differential protection rather than generic protection. The contingency set we identify is bounded by a

15 number linearly proportional to the scale of the system. We do not have to worry that the contingency number will become extremely large.
This dissertation includes three parts: probability, identification, and prevention of rare events.
In Chapter 2, we provide an analysis of the event probabilities of a power system from a general review, as a way to motivate the interest in the subject. Chapter 3 and Chapter 4 reports on work done to identify likely high-order initiating events and calculate the probabilities and risk of contingencies. Chapter 5 describes the dynamic event tree (DET) proposed in this research as an operator decision aid for mitigating or avoiding catastrophic events. Chapter 6 reports results from a prototype DET test system. Chapter 7 concludes.
Chapter 2 addresses the probability of rare events. It presents a discrete probability model for cascading events. It shows that high-order events occur with higher probabilities, which motivates the works of other chapters that follow. In addition, this chapter also jBnds a better way to estimate the conditional probabilities of subsequent events, which provides a basis for the estimation of probability magnitude in Chapter 3. We propose the use of the cluster distribution, derived from a negative binomial probability model, to estimate the probability of high order events in terms of number of lines outaged within a short time. We use this model to St the statistical data gathered for a 30-year period for North America. The maximum likelihood method is employed to estimate the parameters of the cluster distribution. The model is compared against the commonly used Poisson model and the recently proposed Power Law model [41]. Results indicate that the Poisson model underestimates the probability of higher order events while the Power Law model overestimates it. We use the strict Chi-square fitness test to compare the fitness of the three models and find that the cluster model is superior to the other two models in this case. This method may be used to estimate the probability of rare events and can also be used in longterm planning to be well prepared for large events in the future power system. We also discussed other possible approaches to estimating the probabilities of large-scale blackout scenarios.

16
Chapter 3 and Chapter 4 address the identification of rare events and estimation of the risk they pose. There exist a very large number of possible contingencies in a large-scale interconnected power network, and it is impractical to analyze them one by one. Therefore a standard approach is to analyze only a subset of the contingencies. The normal method of selecting this subset is via use of the so-called JV-7 rule. In Chapter 3, we go a step further by proposing a new method of forming a high-order contingency list, based on substation configuration obtained from topology processing data and probability analysis of protection system failures. This method is particularly suited for on-line security assessment. Protection system failures assessed include stuck breakers and failure to operate. We present ways to identify the above events in a schematically way. Furthermore, we give a concise form for the probability calculation of the stuck breaker failure events. In Chapter 4, we first analyzed the risk posed by the high-order contingencies we identify in several typical substations, as an example for the application of our identification approach in Chapter 3; then, we study the load shedding risk of IEEE-RTS 24 bus system due common fault contingencies, stuck breaker contingency and inadvertent branch tripping contingency under difference loading condition.
The last part of this dissertation, including Chapter 4, Chapter 5, and Chapter 6 proposes a possible solution to cascading events in power systems: dynamic event tree (DET). It is based on the observation that many severe events follow a pattern characterized by slow successive component tripping in the early stage. This part of the dissertation discusses the attribute and construction of DET. If a system is building up a cascading, halting the trend at the early stage may be the most cost effective way. A detailed account of the concept of the dynamic event tree, its elements, and how a system operator may use it is included. Chapter 5 presents a prototype implement of on a 21-bus test system. Chapter 6 compares the DET and system protection scheme (SPS).

17
In this chapter, we show that high-order events occur with higher probabilities, which motivates our works on the rare events of power systems in the later chapter. This chapter also finds a better model, compared to the frequently discussed Power Law model, to estimate the conditional probabilities of subsequent events. It provides a basis for the estimation of probability magnitude in Chapter 3.
We discuss in this chapter three possible probability models: Poisson, Cluster, and Power
Law. A specific form of the negative binomial distribution that we call the c/zt?fer model is developed. We use maximum likelihood estimation to estimate parameters for the cluster,
Poisson, and Power Law distributions in describing outage statistics from North American power grid histories over a 30-year period. A chi-square fitness test is performed on the three models to compare their fitness.
There are three ways to estimate the contingency probabilities of power systems. The first is to fit an existing probability model to historical data; the second is to use physical attributes of each individual event; the third is to use Monte Carlo simulation with variance reduction. We report on investigations via the first approach. There are also different metrics to use in characterizing the rare events of power systems, including number of customers interrupted, power interrupted, energy not served, and number of elements lost (AW, A^2,...).
We use the latter characterization in our probability model because it better conforms to planning and operating reliability criteria used in industry. For example, reliability standards performance criteria are often categorized based on the number of elements lost.
Obtaining probabilities for high-order contingencies poses difficulties for power engineers. Their rareness means there are not enough statistical data to build a credible probability model for them. The occurrence of high-order contingencies, especially those

18 catastrophic ones, is usually illusive with causes irregular and unexpected. Usually a very large part of a power system suffers when they occur. This feature makes it is hard to use the traditional state space model [17][16] approach to study them, which have too many unfounded assumptions and only suited for small or simplified system. As a rule, engineers have to examine specific power system components, topology, generation, and load pattern to evaluate a specific system's vulnerability to high-order contingencies. Among a few works that study modes for the probability of high order contingencies, a Power Law approach was first proposed in [42]. This model is in accordance with the existing large power outage statistics in the sense that it predicts that large events happen with a much greater probability than commonly expected. In addition, according to [42], a power system does not always exhibit Power Law until it is heavily loaded, which limits its application to other power system conditions. Although heavy overloading is a major contribution to large power event, many other condition such as unfavorable topology condition [43] and incorrect protect behavior may also trigger huge outages. For example, the December 14, 1994 California outage occurred at midnight and cut service to 1.5 million customers. Another event is the
Brazil outage caused by bus fault; the Italian event [15]. To prove the fitness of a probability model, a strict statistic test will be used. We especially want to compare the fitness of different models that appear St and appropriate otherwise.
In this chapter, we will discuss different ways to estimate the probabilities of rare events in power systems and examine the application of three probability models (Poisson, cluster binomial, and Power Law) applied to the jV-& outage statistics for a 30-year period in North
America [4]. We will find that negative binomial model is the most appropriate. We first give some background knowledge about the three probability models in next section. Then we reparameterize the probability model to deduce the cluster model for the distribution of transmission line outages in power systems. In section 2.4, we use the maximum likelihood method to estimate the parameters of the three models to fit the data. The Subsection 2.4.5 uses the strict - test to comparison the fitness of these models.
The raw data we are going to analyze throughout this chapter is from reference [40].
This data is replicated in condensed form in the table below.

19
N-l
N-2
N-3
N-4
N-5
N-6
N-7
N-8 luin. type
Table 2.1 High order transmission outages statistics
ZEEE survey oft/SaW Canodzon overAgacf
(ra/w/»KfioM owfagay of 2JOtv oW oAove, 796J-7P&S [40]
Number of Contingencies By Voltage Levels
230kv line 345kv line 500kv line 765kv line
3320
303
39
18
7
0
3
2
5807
577
99
16
1
1
1
0
0
0
0
0
721
35
3
0
295
36
2
2
0
1
0
0
10143
951
143
36
8
2
4
2
Table 2.2 Total number contingencies in each single or multiple contingency categories
Cont. Type N-1 N-2 N-3 N-4 N-5 N-6 N-7 N-8 k
1 2 3 4 5 6 7
10143 951 143 36 8 2 4
8
2
The data we analyze is the total number of elements lost in each contingency in North
America from 1965 to 1985 [40], as indicated in Table 2.1. The last two columns give a summary by voltage levels. According to [40], the data reported in Table 2.1 adheres to the following:
-0- Each individual component tripping in a multi-component outage event must occur within a 1 minute interval; otherwise, it is considered a separate outage event;
Whenever an event involves components of different voltage levels, it will be counted as one instance only with a specific voltage level;
4- Only line outages are reported. Other components such as generators, transformers, and capacitors are not reported.

20
We introduce several probability distributions in this section. These are important since we are going to use them later.
2.2.1 Poisson Distribution
We derive the Poisson distribution in a traditional way. However we also introduce another way to derive this distribution, and as a result, the Negative distribution as well.
While the first derivation is commonly presented in standard probability text, the second one is quite different from the traditional one; it is first presented in a monograph [18] of W.A.
Thompson, Jr. We will show how the latter is used to model the probability distribution of simultaneous multiple contingencies.
Consider the event of an individual line tripping within a fixed time period by a binary random variable 7 , such that T e {0,1} , with 7 = 1 representing line tripping and
Pr(T = 1) = ^. The probability of tripping of each line follows the Bernoulli distribution
Pr(T = f|/?) = y(l-p)'"'; f = 0,l; 0<f <1. (2.1)
Suppose the total number of circuits in a power system is #. Assume that each has the same probability to be tripped within a fixed time and each trip event is independent of another. We want to study the probabilistic distribution of defined to be the total number of lines removed from the power system. This is important within this work because it provides some basis for estimating the probability of contingencies. We have the following binomial distribution for calculating the probability of M = & :
Pr(M = &) = f AA
(1- /?)""*, where & = 0, 1, 2, 3,...,# and p=Pr(r=7) (2.2)
Usually, is small and n is reasonably large, in which case T = 1 becomes a rare event
[18] and can be approximated with the Poisson distribution
Pr(M = &)= /(I-f)"-* «Pr(# = &|A) = /1!
(2.3) Pr(M = &)= l&v
/(1-f)"-* «Pr(# = tpl) = where /I = , & = 0, 1, 2, 3,...,oo.
/A!

21
The Poisson distribution is sometimes called the distribution of rare events [45]. Both the rare event system and the approximation of binomial distribution with Poisson distribution assume that the element events (the failure of an individual) are independent, i.e., the failure of one component does not affect the failure probability of another component. These may be the theoretical basis for power system engineers to omit most multiple contingencies since their probability is so small, based on this model.
2.2.2 Negative Binomial Distribution
Another family of discrete distributions that are similar but different from the binomial distribution is the negative binomial distribution models. We do not derive the negative binomial distribution here because the derivation process using the classical urn model [18] to get the common format of negative binomial distribution is of little relevance to power systems and rare events. The reason we present this distribution is that we are going to use another form of this distribution to study the distribution of multiple contingencies in power systems. Rather than counting the number of successful trials after doing a predefined number of Bernoulli tests as in binomial distribution, the negative binomial distribution counts the total number of tests to get a predefined number (M) of successes. Suppose T is the random variable that represents the number of failures before a predefined (M) success test is observed in a sequence of Bernoulli (p) tests, then the distribution of T is
The distribution is typically called negative binomial (M,p). The range of M here can be extended to that of real numbers.
A special case of negative binomial distribution is the geometric distribution, where f=7, so that the above equation above becomes^:
(2.5) where p = /%,/(! +A), * = 0, 1, 2, 3,...,oo.
2.2 J Power Law Distribution
A random variable % that follows a Power Law has a normalized distribution as follows:
^ The sample space of standard geometric distribution is {1,2,3,. ..,00} rather than {0,1,2,3,. ..,00} .

22
Pr(% = z|p) = -7-^—;p>0
1% "ak
(2.6) where c is a constant. % can either be a continuous variable or a discrete variable. We divide by the constant F %"dkto make sure the expression is a proper pdf. The range of the integration is the sample space. In case the sample space is discrete and % is a discrete variable, is equivalent to . If the sample space of the random variable is infinite, e.g. %e{l, 2, 3, - } or 0 < % < oo, then p has to be greater than 2 so that the mean of % is bounded and p has to greater than 3 so that the variance of % is bounded. When studying a system with the known size, we may limit the sample space of % so that range of c can be less than 1.0.
If we draw the relationship of and % on a log-log plot, we can use a straight line with slope rate -<V jx"ak as
(2.7)
Ix 'ak
This feature is unique to Power Law distribution among many other pdfs that model the probability of rare events.
In Figure 2.1, we plot the number of circuits involved versus frequency, which is from
Table 2.1 on the following double logarithmic graph. We can see the dots roughly distribute along a straight line, that is, the dots follow a Power Law. We use least square curve fitting to find the corresponding distribution parameters, and the constant c is found to be -4.38. There should be two parameters for regression analysis, one is intercept and the other one is slope.
In our case we only use the slope parameter. The reason is that, as we may see from the graph, the intercept is close to zero.
This method is not regular parameter estimation and it does not guarantee a probability distribution. We normalize the above equation by multiplying (2.8) with 0.9434 so that the summation on probabilities of {*=1,2, 3,...} is one.
We will try other regular parameter estimation methods such as maximum likelihood later in Section 2.4.

=
23
M = l, 2, 3, ...00
(2.8)
2 210
310
Solid line
Frequency observed
Least square approximation
1 2
3 4 5
N is the number lines outaged (log scale is used)
6
7
8
Figure 2.1 Least square fitting Power Law to the statistics of line outages
Students who do not know each other studying in a library tend to avoid one another by choosing regularly spaced positions, however if some students are acquaintances or in the same classes, they tend to sit together. Molecules in a room repel each other, Glling the room uniformly; however, bacteria on a plate reproduce themselves and tend to form colonies or
'clusters'. In other cases, insects distribute eggs in a fashion that avoids placing too many eggs in one place [18]. The patterns of these phenomena can be illustrated in Figure 2.2, which is taken from [47]. The first rectangle of the figure shows the placement of the dots tends to repulse each other so that a uniform pattern is observed. If the placing of each dot is completely independent of another, then a random pattern can be observed as in the second rectangle. The third rectangle shows the dots tend to form clusters (or clumps). The circle show the clusters identified by simple visual inspection. In this section, we show the evidence from statistical data in Table 2.1 that the power system outage also tends to cluster and give a theoretical probability model for the distribution of number outaged lines in each contingency. Since we study the multiple contingencies in power systems with respect to time, our study is one dimensional as shown in Figure 2.3, as compared with the spatial distribution of dots in Figure 2.2.

24
Figure 2.2 Comparing uniform, random (independent), and cluster (clumped) patterns
—0 * $-9 S
(*$g)
—-
Figure 2.3 Point process with/without clustering
2.3.1 Cluster Phenomenon and Multiple Contingencies in Power Systems
Clustering of contingencies is expected from a large power system network. We know that contingencies, particularly when a power system is heavily loaded, tend to breed other contingencies. The forced trip of one generator or line changes the flow pattern on the network, and some lines may become overloaded and trip either by proper or unintended operation of a protection relay. Faults and the ensuring relay trip of one line cause transient oscillation throughout the power system and may cause other components of a power system to be tripped also. The more severe the contingency that occurs, the more likely that an additional contingency follows.
One way to study clustering is to model them as a point process [18]. A basic point process is Poisson process, where the time interval between two arrival times follows exponential distribution with parameter { A(f)}. For a homogeneous Poisson process
(2.9) where #[f, f + Af ] is the number of points between time t and f + Af, and A is the arrival rate. If A is a constant regarding f, then the process is called a homogeneous Poisson process.
It is recognized that homogeneous Poisson process as a probabilistic model for the generation

25 of 'points' in a cluster do not St the experimental data in some cases [18]. To find a better model for clustering, people have tried to modify the homogeneous Poisson process.
A modification of the homogeneous Poisson process is to vary the arrival rate as a function of arrivals. When the function is ,3, (f ) = (1 + a x z)/!q (f), some regular distributions for the number of arrival points within time [0, f] can be obtained. The table below summarizes this conclusion [18]. a
= 0
>0
< 0
Table 2.3 Facilitation-hindrance model with A, ( t ) = (1 + a x i ) ^ ( t )
Effect of Past on the
Future Arrivals
Neutral
Facilitation
Hindrance
Transitional probability Type
Poisson
Negative Binomial
Binomial
When a >0, the distribution for the number of point arrivals follows the negative binomial distribution. This model fits the experiment clustering data quite well in some cases in [18].
We are not going to elaborate two much on point process and clustering, since we do not have the statistical data needed to test this model from a time series point of view. What we have in hand is the data of Table 2.1. We will use a classical um model to derive Poisson and negative binomial distribution in uniform way in the next section. The classical um model simulates the process of clustering and it follows a distribution that can be validated through the statistical data in Table 2.1.
2.3.2 À Uniform Model for Poisson and Negative Binomial Distribution
The negative binomial distribution can be derived from the case of n magnetic balls being placed into m urns consecutively so that the probability of transition from occupancy numbers (n, rj, ...,r„) with fo (n+7, rj, with r+7 ball is (a )/%axr+m).
This means the urns that already contain more balls have higher probabilities to 'attract' an additional one into them. This process was illustrated in Figure 2.4, where the second um has a much higher probability to 'attract and capture' the next ball since it has the most magnetic balls in it already. When <%=0, the transition probability is just this distribution of the

26 number of balls (k) in the first cell is just like the case of binomial distribution with parameter p and n, that is
Pr(t|p = l/7M,n)
\ n-k i Y/" i \
I fM
(2.10)
As we discussed in [18], when n — > oo, m oo and n/m —> A this expression can be approximated by
(2.11) kl where A = «//», A = 0, 1, 2, 3 ,...,oo.
However when o>0, we may see that the transition probability is a function of the number of balls already in the first cell; the more balls in the first cell, the more likely the next ball will fall into the first cell. The element events (the action of placing ball) becomes no longer independent, the succeeding event is heavily dependent on what previously occurred. Actually when o>0 with n and r sufficiently large, we get a negative binomial distribution with parameters a-1 and A/(A+<%-7), that is [18] a
X ^
A + or ' where A = m/mand t = 0,1, 2, 3, - ,
' +&-l^
X
X + oc
-i
X + oc
-i
(2.12) ar, +1 i
40 /
Next Falling Ball f**) m = 4 {number of urns) r-Hr t
-12
.. a = 3 a r . + 1 /
Pr ar
(
-f I\
Pr =
Most Likely/
1 = 1 ^ = 6
Figure 2.4 Placing magnetic balls into 4 urns
It seems from [18] that equation (2.12) does not allow or being zero. Actually, equation
(2.11) is the limit of equation (2.12) when <z approaches zero.

27 a-> a
X
= Lim cr-»0
<z ' +*-1 k
= Lim
/?->cc
J3 + k — \
A
\ k
(
(Z -i A" v
A + or '
X p
Y
X + P J \
/
= Lim
/?->oo
^9+t-lV A ^
( / ? + k — 1^ x i^p + k — 2^x • • • x ^y? + k — X k
(2+/?)* (W+l)"
= Lim y?-»co
( / ? + — l) k — 2^ x • • • x (y? + k — k^j X k
- X kl
X
1
= Lim y?->oo
/? + &-! ^ + ^-2 ^ + x— x
X + p x + p J+/9
X
/I* 1
X — -
A:!
À 1 k
(2.13) kl
The result is exactly as expected. Since only the number # of lines being tripped in each contingency is counted and the condition without any contingencies is not counted, # must be greater than 1. We reparameterize the equation (2.12) by 7 = jT+lso that the sample space of random variables is {1, 2, 3, - }. We also reparameterize A by // = A +1 so that
E(F) = /y still hold as E(%) = A in equation (2.11). We will use the notation
C7w.?fer(y = _y !//,#) to represent the newly reparameterized distribution, which is defined to be
C&sTer(y = = a ' + y - 2 y-1
-(M)
(y-1)!
/U-l
//-l + a ^ y j'-i / x
„ - i a
V yU-l + (Z
-1
\
Î/" <z > 0,/y > 1, oMc/ y = 1, 2, 3, z/" a = 0,//>l, oW y = 1, 2, 3,
(2.14)

28 for the rest of this dissertation. We call a the yâcfor and we will show that this a is actually an important index showing the tendency of power systems to have a cascading event.
Unlike the Poisson and binomial distribution, this negative binomial models some interdependency among the element events, since #= 0 in Poisson distribution.
Table 2.4 Parameters of different distribution models
New format of
NB distribution parameters
Old format of
NB distribution parameters f J a r P
2
2
2
0.01
1
3
100
1
0.3333
0.0099
0.5
0.75
Almost Poisson ( A = 2 )
Equivalent To
Geometric Distribution
Negative Binomial
2 7 0.1429 0.875 Negative Binomial
From the graph above, we see that negative binomial distribution has a heavier tail than the Poisson distribution. For o>l, the semi-log curve of negative binomial distribution is convex, in contrast to the Poisson distribution, which is concave. The different shapes of curves show higher k are more likely to happen if k has a heavy tail distribution as the triangular doted curve and the square doted curve shows.
We also draw the relationship of Pr(%=&) v.s. & in the actual statistics of Table 2.2 as in the right hand side of Figure 2.5-2.7 above. The shapes (concave or convex) of curves in the three figures match the shapes of Cluster distribution when <%>3, which suggests cluster model with oc>3 could be a good model.
2.3.3 Convergence Rate Comparison of Power Law and Cluster Distribution
Based on the discussion in Subsection 2.2.3 and 2.3.2, we form a table that summarizes the rate of convergence rate of the pdf of the several probability models as the random variable approaches infinite.
From the above table, we see that when z —> oo, i.e. for when events became large or
'rare', we have

29
0 < ju — 1 + CKj
<a^- < f -
X
< 1 jj. /y — 1 + c?
2 which means the convergence speed when the events becomes rare is as follows
( 2 . 1 5 )
{Powjon) > {C7wafer(l > a > 0)} > {Geometric} > (C/iwfer(a > 1)| > {fowerLmv}
Table 2.5 Comparing convergence rate with Cluster & Power Law pdf shapes
PDF Family
Poisson
(4
Cluster
(//,!> a, >0)
Geometric
Or Cluster
( / 4 « 0 = 1 )
Cluster
( / / , a
2
>1)
Power Law
( c > 0 )
Pr(% =% + !)
Pr(% = x)
When x —> oo
A z + l
0 oÇ
1
+ x -1
X x
[i — \ x
, u -1 f i-\ + a~ l
/ / - I n ju-l
M cc
7
+ x — 1
X
X
//-I
. jl — 1 + C?
2
/ / - I ju-l + a
2
~ l
HT
1
Shape of
% Vj.
Pr(Z = z)
Shape of
X vs. log{Pr(% = %)}
Shape of log(x) VJ. log{Pr(% = %)}
Concave
Concave
Convex
Concave
Concave
Convex
Concave
Straight
Line
Convex
Concave
Convex
Convex
Concave
Convex
Straight
Line
The rate of convergence here is actually an index representing how heavy the tail of the pdfs or the likelihood of rare events are. The faster the convergence speed, the less likely a rare event occurs. For Poisson distribution, since it assumes the independency of events, it converges faster than any of the five distribution families we discuss. The convergence speed of Cluster distribution is dependent on a , which is just a parameter showing the interdependency of events, or tendency of clustering to be more specific. The larger the a, the slower the convergence and the heaver the tail of pdf of cluster distribution.

30
Cluster(y\ii, a
0.8,
O Oi«r<r(y|// -
• anster(y\ju = 2, a = l)
ES Cluster(y\fi=2, a=3)
Probability Observed
0.i p (X=k) v.s. k
|
I
|
\ogClitster{y\fi,
10°
1 2 3
Number Of Lines Outaged
1
*—f 1
4 5
6
>er Of Lines Outaged
Figure 2.5 Cluster distributions and actual frequency (linear scale)
Probability
Log) Pr(A=A:) i v.s. k
\o%auster(y\iJ,
10°
9 Chister[y\fi=2, a=0.01)
Gnster(y\/j=2, a=l)
0 Ovster{y\/j=X «=3)
• Ouster(y\^=X a=7)
1 2 3
Number Of Lines
4 v
5 ' 1 2 3 4 5
Number Of Lines
Figure 2.6 Cluster distributions and actual frequency (semi-log scale)
Probability Observed
Chister(y\fj=2, a=0.0l)
Qisler(y\ft=2, a=l)
Ù-.Omter(y)fj=2, c=3)
C7tisZei-(j;|/j=2, «=7) log( Pr(,Y=&) ) v.s. Iog(t)
Number Of Lines Outaged log(y)
2 3 4
Number Of Lines Outaged
Figure 2.7 Cluster distributions and actual 6equency (log-log scale)

31
The data we are going to analyze is the total number contingencies in each single or multiple contingency categories from the Table 2.2, which is a summary from the Table 2.1.
Table 2.6 Total accumulative number of contingencies in each single or multiple contingency categories
Cont. Type kai k>2 k&3 k>4 kâ5 k26 k>7 k >8
Accumulative Count
Conditional Prob (%)
11289
-
1146
10%
195 52 16 8 6 2
17% 27% 31% 50% 75% 33%
Table 2.6 is an accumulative count of the number of the contingencies Table 2.2. The advantage of this table is that we can calculate the conditional probability of additional line tripping given the number of line outaged within one minute. From the second row of Table
2.6, we may see that this probability generally increases with the number of lines already been tripped. When &>7, we see a decrease, which is reasonable since the actual statistics has to stop somewhere.
2.4.1 Maximum Likelihood Estimation
We use all the three models: the Poisson, Power Law and the Cluster distribution model to analyze the data in Table 2.2 and compare them. This section introduces the maximum likelihood method to estimate the distribution parameters).
The maximum likelihood approach is the most popular technique nowadays [50] for point estimation. Suppose --, arc one independent identical sample from the space X with probability distribution function/(xl#,, 0%, -, distribution function is
Pr(Z, A,, -, %,)= the joint probability
—, %,)(% 16)
Maximum likelihood approach defines a likelihood function
-,%»)= fi ie{l, 2,
-, %,) (2.17)

32 which is equal to the joint probability distribution function but switches the parameters and variable, i.e., takes the sample value parameters and (^,^, -,^,) as variables instead. If we transform (2.17). by taking the logarithm of both sides, then we get the following log likelihood equation l0gl(2,, %, 22 10g/(%,|#,,
#e{l,2
#„) (2.18)
Define ^ = (^, - -, ^,) andz = (jc,,^, - ,Jc^).The <9(z) that maximizes Z,(^|%)is called a maximum likelihood estimator of the parameter 0 . #(%) must be a global maxima according to the maximum likelihood principle. Because it is usually easier to find the maxima of (2.18) than that of (2.17) by differentiating the equations, we will use the log likelihood function in this dissertation.
If we assume the sample data follow a Poisson distribution, then only parameter A needs to be estimated. Poisson distribution is a special case of negative binomial distributions in the form of (2.12), where a = 0, so there is no clustering for this model.
Suppose we observe N* samples of = & from the Poisson(A) such as in (2.3) and the sample space of AT is {0, 1, 2, 3, -}. The likelihood function will be l o g l ( A | # g , # , , l o g
& !
JV* x log
(2.19)
In order to find the candidate Â(A^, -) that maximizelogZ^ApV^A^, we need to solve
91ogZ,(A|JV„A^, -
9A
Since
0 l o g T V , , g
^^7^8
_
(2.20)
^ „ A! a Tg"^*^
= 2,

33
As{0,!,-
N l
* - ^ x { k x e l
X " - e i
V ) ie{0,l
*e(0,L - }
= r' % k
- X j v , ie{0,!,•••} fte{0,!,•••} (2.21)
We have o=A-' te{0,!,•••}
&x#*- i:e{0,l,-}
^
Thus we get the maximum likelihood estimation of A :
(2.22)
t
(2.23)
IX
4=0 which is just the sample average.
For the cluster distribution, it is a little bit complex to deduce the maximum likelihood estimation of A and or . We will consider the case a > 0 , since if « = 0 , the cluster distribution is equivalent to the Poisson distribution which we just discussed. f oT'+y-2l
v — 1 y y-1 f or
-i \
X v
//-1 + a"
_/ôry = l, 2, 3,
(2.24)
Suppose we observe samples for each AT, the likelihood function will be
X r i ( Z ^ + t - 2 l o g l ( a , / / | # , , ^ ^ 8
<. *-1 /
l ^ x l o g
MU.-)
+ ^ - 2 ^
" + log v ^ - 1 V
M - l ' '
I [(i-1)-",]
+log
//-l + cr ^
Vte{l,2,--(
J
(2.25)

34
In order to find the candidate pair (â,//) that maximize the function log 2(a, /j JV,, #2, -, JVf, , we need to solve a pair of equation as follows
61ogZ,(a,//|#„#2,-
6a
0 log ! ( < % , / / # 2 , -
(a„u)=(â„û)
= 0
= 0
(2.26)
The two equations are far more complex than those for Possion. However, we can still solve analytically.
T?
' ) - ( / / - l ) ^
= ( ^ . ) ( ^ i
+ a
- ' ) x
X ,
[ ( t _ I )
'
W
'
]
+
-a
, x
//-l + a Mu. ; or 'x ke{
1,2,—}
(p-l)(jW-l + e~')
-
I *N, -JU
_*e{ 1,2,-}
Z
_*e{l,2,-}
X
ke{
1,2,-} y
(2.27)
Then we got the same formula as that for Possion
A _ *41.2, ')
I
N
*
-}
(2.28)
Thus we get a closed form solution for //, however we have difficulty in finding a closed form solution for â. Although it is possible to use numerical techniques such as Newton method or advance statistical method such as EM method [50] to solve them or, we are not going to try, rather, we will search the maxima pair (#, //) for log .&(«, //1TV,, - ) directly using the contour graph function in Matlab. It is much easier to understand in this case.
The likelihood function for Power Law distribution is

35 k~]
'r-P xlog-
k=l J
=
*=l V t=i
X y v t=i )
(229)
Like the (% in Cluster distribution, we cannot get a close form solution for p since the equation
\ /
0 = - p * Z ( ^ * x l o g t ) - l o g ^ x
V*=1 ) X i=l 7 VH y
(2.30) cannot be solved analytically. We will use graphical method to find the maximum Since we have only one parameter to be estimated, it is easier for us to find p than the ( â , fi ) pair in
(2.26).
2.4J& Estimating the Parameters Of Poisson Distribution
According to equation (2.23), we have a close form solution for the  in Poisson distribution, i.e.
 = %Xt-l )Ar* /%]#*= 0.1262 t=l / i=l
The maximum likelihood estimate of  for Poisson model is 0.12657, i.e.
(2.31)
Pr(F = t) =
Where t = 1, 2, 3, -
-1) ! = 0.1262^/( A: -1) ! (2.32)
Note we changed the sample space of standard Poisson distribution to {1, 2, 3, -} because the sample data we have ranges {1,2, 3, 4, 5, 6, 7, 8} which is void of zero element.
2/4.3 Estimating the Parameters of Cluster Model
Substitute the &'s and the#* 's in the likelihood function in equation (2.25), we get the contour and 3-D graph of the likelihood function logZ.(<z,/j A^,--) as Figure 2.8.
In order to get a more precise numerical solution, we further narrow the range of «% and // to get the magnified plot in Figure 2.9 The maximum likelihood estimation of a and // is approximately

36
«s 3.08189
1 .
[/y «1.12623
(2 33)
According to equation (2.28), we actually don't need to read the estimate of // from contour graph. Using the formula for //, we have s
^ =
*=1 y 8
/ k=1
1.12623 (2.34)
This is very close to our estimate of // 6om contour graph in Figure 2.8 and Figure 2.9, thus it actually partially proved the correctness of our method.
Likelihood
1.139
1.137
1.135
1.133
1.131
1.129 kl
1.127
1.125
1.123
1.121
1.119
1.117
1.135
1.13
1.125
1.12
1.115
3.5
3.2 3.4
2.5
2.4 4.2
Figure 2.8 Contour and 3D plots of maximum likelihood for Cluster distribution (I)
1.129
1.1285
1.128
1.1275
(=3.082, m=1.12_625
Likelihood
1.4x 10
6 x
1.3-
1.126
1.1255
1.125.
1.129
1.128
1.127
1.126
3.04
3.08
3.12
3.08 3.1 3.2
Figure 2.9 Contour and 3D plots of maximum likelihood for Cluster distribution (H)
3.2
2.4.4 Estimating the Parameters for Power Law Distribution
In order to estimate the Power Law model described in Subsection 2.2.3, the least square curve fitting is used to estimate the approximate range of the slope . It is around
4.0. The likelihood function (2.30) with p ranging from 3 to 6 is plotted in Figure 2.10. In

37 order to get a more precise solution, we further narrow the range ofand get Figure 2.9. By observation, we find c = 3.7553. Then the estimated Power Law distribution for the data in
Table 2.2 is
P(X = x \ c =
3.7553) = x
-3.7553 •3.7553
I*' k=]
(2.35)
Log-Likelihood
-4800
Log-Likelihood
-4449.030
-4449.032
4449.034
-4449.036
-4449.038
-4449.040
C
=3.7553
C=3.75
-4449.042
-4449.044
3.754
Power index c
3.756
Figure 2.10 Plot of maximum likelihood function for Power Law
3.758
Three different probability distributions by maximum likelihood estimation from the data in Table 2.2 are summarized in a group as follows
¥ r { X
= x| a
= 3.082,/v = 1.1262) =
3.082"'+%-2 x - 1 y
1.1262-1
1.1262-1 + 3.082 y
/ n. 3.115-
3.082"' x
^1.1262-1 + 3.082 y for cluster model
(2.36)
Pr(% = =0.1262) = g^'^0.1262"'/(x-l)! for poisson model
Pr(X = = 3.7553) = 0.9080%"^^ for power law model where z e {l, 2, 3, - } for all three models.
2.4.5 Comparing Cluster Model with Poisson and Power Law Model
Substitute k in the above formulas, we have the following Table 2.7 and Figure 2.11-2.14.
Obviously, the Cluster model (the curve dotted with squares) is superior over the other two models. Except for some mismatch in the extreme events the cluster model (the curve

38 dotted with squares) fits nearly perfect with what we have observed (the curve dotted with diamonds). The curve generated by the Power Law model dotted with triangles locates above the observed curve starting from k=3, which means it overestimates the probability of large contingencies. The concave curve generated by Poisson model deviates from the observed data significantly. It underestimates the probability of large events (&>3) to the order of more than 10 ^ times. This result is in accordance to our qualitative analysis in Section 2.4 . The observed data plot on semi-log scale is concave and double log (log-to-log) scale is convex.
Among all the three probability models we discussed, only the pdfs curve of cluster model
(or negative binomial) has such feature. For these pdfs, the affinity factor « of the cluster model must be great than 1, otherwise the semi-log plot of the pdfs is still concave. The estimated â is equal to 3.082, which is greater than 1, just as we expected. These prove our judgment from the qualitative analysis in Section 2.4.
Cont. Type
Table 2.7 Probabilities of contingencies according to estimated pdfs
#-1 N-2 #-3 N- 4 #-5 N- 6 N-7 k 1 2 3 4 5 6 1 8
Observed No.(W t
) 10143 951
Observed Prob.
143 36 8 2 4 2
0.8985 0.0843 1.267E-02 3.189E-03 7.087E-04 1.772E-04 3.543E-04 1.772E-04
Cluster (43 12.1.13) 0.8989 0.0817 1 515E-02 3.288E-03 7.657E-04 1.854E-04 4.607E-05 1.166E-05
Poisson (A—110.1266) 0.8814 0.1113 7.022E-03 2.955E-04 9.324E-06 2.354E-07 4.952E-09 8.930E-11
Power Law (fc|3.78) 0.9080 0.0672 1.467E-02 4.979E-03 2.154E-03 1.086E-03 6.088E-04 3.687E-04
Log-Probability Log-Probability
Powej - Law Modël
(Convex) ; \
Observed Prob
X(Convex) :
Power Law Model ]
(Straigjit line) \i
\
0 bUn/ed
Prob.
(Cone;
Poisson Model
(Concave
Poisson Model
(Concave)
Joncavej
Cluster Model
1 (Convex)
10' 10
Number of lines lost in each contingency Number of fines lost in each contingency (log scale)
Figure 2.11 Semi-log and log-log plot of pdfs for Poisson, Power Law and Cluster model

39
Although it is convenient to make the judgment that the cluster model fit best the multiple contingencies statistics by simply inspecting the curves and Figure 2.11-2.14, we will use a quantitative method to test the fitness of the fitting: -square test.
Chi-square test is widely used in statistics to test the fitness of a probability model to sample data, not matter the model is continuous or discrete. Chi-square test is based on the
Pearson theorem [52][53]. Before introducing this theorem, it is necessary to present the polynomial distribution [SO]. Suppose a certain random trial has & different results, the probability that each trial ends in the z* result is # , z = 1, 2, 3, -, t and =1. If we do the trial for a total of n times and we denote as the total times the z'* result show up among the m trails, then the multiple distribution of JV, is
Pr |A,' ) = —r-y ; ^ (23?) where k i~\ k
=/% and T]# = 1. i=l
Suppose the parameters of a polynomial distribution has the pdf as in
(2.37) and define y ^ (
M M#
2 .
then when % -» oo,j/ follows the chi-square distribution (t-l).
3 8 )
In equation (2.38) the statistics is actually an index showing how the samples deviate from the polynomial distribution to be tested. The larger the statistics the larger the deviation.
In order to apply the Pearson theorem, we need to convert the distribution we are going to test into polynomial distribution. Since the sample space of the three distributions we are going to test is {1, 2, 3, -} and it is a discrete infinite set; we need to group it into a finite number of exclusive subsets. We group the sample space {1, 2, 3, - } into t exclusive sets denoted as 5% z = l, 2, 3, - , & . Suppose % is a random variable and its pdf is /(%) = Pr(Z = x), xe{l, 2, 3, - } . We draw a total of n samples of % from pdf /(%) and count the number (denoted again as AT ) of samples that are members of the set S,.

40
Denote p, = Pr(%. Then the random variables z = l, 2, -- follows the polynomial distribution we just described.
The Pearson theorem assume all the parameters for the distribution to be tested is known.
If any parameter is unknown and 's are estimate rather than known values, we need to reduce the freedom number of the ^ distribution. The rule [52] is, if there a total of r estimated parameters, the freedom number of the is & -
The hypothesis test is designed as follows:
MOMpfe? come PDF /(%) versus
: fAe TTze aa/Mp/a? do nof come PDF /%%)
Prior to perform the test, setup a confidence value #, 1 > «> 0. If then reject , else accept ^. Usually a is set to be 5%, 2.5%, or 1%.
(^-r-l),
Table 2.9 lists the value of item # and for each of the three models. We can see that:
When z > 6, j?, x JVare all less than 1 for Cluster model;
When z>4, # x p, are all less than 5 for Poisson model.
When z = 4, x y] n, are all less than 5 for Power Law model.
/ n, (N = %)»,= 11290)
Pi
Table 2.8 Grouping the sample space for ^-test
1 2
10143
0.899
951
0.082
3 4 5 6 7 8
143 36 8 2 4 2
0.015 3.3E-03 7.7E-04 1.9E-04 4.6E-05 1.2E-05
Pi
10147 922.14 171.03 37.12 8.639 2.093 0.5201 0.1316
0.8814 0.1126 7.0E-03 3.0E-04 9.3E-06 2.4E-07 5.0E-09 8.9E-11
9950 1256 79 3.336 0.1053 2.66E-03 5.6E-05 1.00E-06
0.9080 0.0672 0,01467 4.98E-03 2.15E-03 1.09E-03 6.09E-04 3.69E-04
Power Law
Pi p.# 10250 759,069 165.58 56.21 24 12.26 6.873 4.1626

41
In order to have a uniform test on these pdf models, we group all z's that are greater than
4. Then we generate a new table as Table 2.9.
The test result is summarized in Table 2.9. The last row of the table lists the freedom number of the -square distribution, and statistical quantities for chi-square test, the probability of getting a sample deviation larger than observed, assuming the sample comes from a certain probability model. The cluster model is far more fit than the other two. While both Power Law and Poisson model are not good, Power Law is the far better than Poisson model. i n, (#=11289)
Pi i
10143
0.899
10147
2
951
0.082
922,14
3
143
0.015
171.03
4
36
3.3E-03 1.01E-03
37.12
>=5
16
11.38
18.3299 832.63 785.85 1.2435 21.309
(n, -#7zy/p,M 0.0018
Pi
0.8814
A"
9950
0.9029
0.1126
1256
4.5948
7.0E-03
79
0.0335
3.0E-04
3.336
1.8719
9.56E-06
0.1079
37144.7 93033.2 4061.17 1066.97 252.556
3.733
Pi
0.9080
74.07 51.23 319.882 2339.05
0.0672 0.01467 4.98E-03 4.22E-03
10250 759.069 165.58
16411.21 41333.37 341.24
1.12448 48.52 3.079
56.21 47.613
339.63 1466.75
7.267 20.99 of/' Test p t n
If we set a) to be 1%, then
(2) = 9.21 <
(2) = 9.21 and (3) = 11.345, we can see that
= 7.405 for Cluster model, so accept 77, and reject

42
%^(3) = 11.345< V"——^ = 2 7 8 7 . 9 f o r P o i s s o n m o d e l , s o r e j e c t # @ a n d a c c e p t
A"
, i.e. Poisson model is not a appropriate model for the data.
(3) = 11 345 < V"——^ = 8 0 . 9 9 f o r P o w e r l a w m o d e l , s o r e j e c t ^ a n d a c c e p t
A»
, i.e. Power law model is not a appropriate model for the data.
This chapter proposes the cluster model for computing probabilities associated with highorder events. This model is very appealing because it provides the ability, through the affinity factor a, to capture the tendency of component outages in power systems to increase the likelihood of successive component outages, for example, cascading phenomenon, so that they cluster. The cluster model is actually a quite general model, with the familiar Poisson
(complete independency between events) being a specific instance of it, where When a is very large, the Power Law and Cluster models both exhibit similar behavior in convergence rate as the event becomes very large. In our application to real data, we observed that Poisson underestimates rare event probabilities, Power Law overestimates them, and the cluster model captures them very well. This observation was confirmed using a statistical test of model fitness. The results of this work will help us estimate the probability of contingencies so that we can calculate their risk more precisely and further more, it also enhance decision making at both the planning and operational level. In particular, operational procedures for defending against large outages are of great interest to us, and the cluster model is a promising aid in directing computational resources as they are used on-line to develop defense strategies as real-time conditions change. Work to this effect will be presented in Chapter 5.
The proposed model provides a basis for system operators to estimate the probability of a next event given the current system condition. This model is also useful to power system planning engineers. They can use this model to estimate the probabilities of higher-order contingencies in the long run. However, the proposed model is quite general and it treats a

43 power system as a whole. Thus it is not aimed to identify specific contingencies; nevertheless it provides a basis for the calculation of specific contingencies in power systems, which will be addressed in the next chapter.

44
In this chapter, we will present a systematic approach to extend the traditional contingency list for the security analysis of power systems. The common practice to set a power system operational margin is the so-called JW rule, i.e., a power system should be operating normally after the lost of any single component. The rule has been challenged by the recent occurrence of big blackouts as well as operator experience. Due to the low probabilities of contingencies, it is very hard for system operators to do any thing opnon to prevent them because it is not cost effective. Yet, contingencies do happen and when they happen, they bring great trouble to operators. The algorithm discussed in this chapter, if applied to real system, continuously yields a "high-order contingency list" in addition to the conventional contingencies within the EMS. We will need the extended contingency list to generator dynamic event tree, which will be addressed in Chapter 5 and Chapter 6.
The purpose of this chapter is not to find all higher-order contingencies. It is not even to identify all JV-2 contingencies; rather it aims to include more N-k contingencies with higher probability to occur and thus high risk.
Pr(N-l)*90%
?
? a
?
25
à
« o
£ z z z z
NJ
II IT o z z
Figure 3.1 Lower order contingencies occupies the most probability space
As suggested by the actual statistics of Table 2.1 and the cluster model, most occurrence (about 90%) of the initiating contingencies are 7V-7, which constitute a tiny amount of all possible contingencies. This phenomenon is illustrated in Figure 3.1.

45
The NERC Disturbance Analysis Working Group (DAWG) provides a database on large disturbances that have occurred in the bulk transmission systems in North America since
1984 [4]. Our analysis of this information resulted in a classification of three types among those related to protection failures: (1) inadvertent tripping, (2) protection relay fail to trip, and (3) breaker failure. A summary of the DAWG database in terms of this classification is given in Table 3.3. If we assume that Table 3.5 represents reasonably accurate statistics, then our approach addresses between 34% and the 45% of protection failures that are branded as categories 2 and 3.
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
Total
Percentage
Table 3.1 Summary on disturbances caused by protection system failures ear
Inadvertent
Tripping
Protection fails to trip
Breaker
Failure
Total No. protection malfunction
1984 4 0 1 5
6
0
3
1
1
2
1
2
6
2
5
2
1
0
0
0
2
1
1
0
0
1
0
0
0
1
0
0
0
1
0
1
1
2
3
3
5
2
0
0
1?
1
2
0
0
6
3
5
4
4
7
4
2
6
3
3
5
7
0
1
36
55%
7
11%
22
34%
65
100%
Transmission substations are normally designed to ensure that a single fault results in at most loss of a single circuit. However, the actual substation topology, at any given moment, may differ from the designed configuration, as the topological configuration of a substation, in terms of the connectivity of the elements through the switching devices (switches and breakers), may change. Variations in substation topology can occur as a result of operator

46 action for purposes of facility maintenance and for purposes of mitigating undesirable operating conditions such as high circuit loading or out-of-limit voltages. To a lesser extent, topological variation may also occur as a result of forced outages.
Substation topological variation may, in some instances, result in situations where the operation of the protective systems, in response to the occurrence of a fault in the network, removes two or more elements when clearing the fault. Such topologies significantly increase the risk-level of the network, as it exposes the system to a multi-outage contingency as a result of a single fault, whose probability is equivalent to that of an JV-7 contingency. As contingencies are inherently more severe than #-7 contingencies, an 7V-& contingency having a probability of the same order of magnitude as an N-l contingency may cause a very high amount of risk, since risk associated with a specific contingency is the expected value of the contingency consequence [33].
An operator may not be aware of increased likelihood that results from switching actions. In this case, automated detection is critical. Even if the operator is aware of the increased likelihood, the question remains as to its severity and therefore its risk.
We have developed a search algorithm and associated code to detect these situations. The inputs required for the algorithm include the breaker-switch status data obtained from the
SCADA system. As this data is also used for EMS topology processing, it is available in most control centers.
Another cause of events is the failure of a breaker to open under a faulted condition.
Such an event is of lower probability than that of an JV-7 outage, as it is comprised of a fault and a protection system failure. Thus, it is of order-2. Yet, the severity, in terms of number of outaged elements, may be extreme, and therefore the risk may be non-negligible. The graphsearch algorithm we have developed also detects this situation.
We provide three motivating examples in Figure 3.2, Figure 3.3 and Figure 3.4. Figure
3.2 shows a simplified two-bus station. The three lines are connected to backup bus 2 without breakers. Normally, the three lines are connected to bus-1, bypass switches 1-3 are open, and loss of all three lines requires occurrence of a fault together with a failure of the primary protection to operate, a scenario of order-2. When bus-1 needs maintenance, breakers 1-3 are open and switches 1-3 are closed. This situation makes the substation more vulnerable than

47 usual. Suppose line 1 has a fault. Since switches 1-3 do not have the capacity to interrupt current, the three lines have to be cleared together, resulting in an AW contingency caused by a single fault. Thus, the bus maintenance activity degrades an AW event from order-2 to order-1^. Even under light load conditions, this can cause a considerable change in risk. ii
L2 13 LI 12 L3 sj Vû
[
A
3
BUSBAR-1
4
â
BUSBAR-l
O'o- O"o^
BUSBAR-2 backup BUSBAR-2
Figure 3.2 N-3 Exposure increases from probability order 2 to 1
(when performing maintenance on a double breaker-double bus configuration)
As a second example, a substation with double breaker and double bus (DB-DB) is shown in Figure 3.3. This design is advantageous relative to a single-bus-single-breaker (SB-
SB) configuration because it is convenient for bus maintenance, and it is robust to high order contingencies like what would occur if a line fault were followed by failure of a primary protection system. For example, if a fault occurs on line LI, but breaker B1 fails to open, B2,
B3 and B4 can serve as backup to isolate the fault, limiting this order-2 scenario to an AW outage. However, if one of the two buses is out of service, as shown on the lower hand side of Figure 3.3, a fault on line 1 followed by breaker B1 failure to open requires that B2, B3, and B4 operate as backups. Thus, an order-2 scenario results in an N-4 event, taking the substation entirely out of service. Its robustness to high-order contingencies degraded to that of a single-bus-single-breaker configuration because of the maintenance.
^ The "probability order" indicates the order of magnitude of the event probability. It originates &om the consideration of multiple independent events, with each event having occurrence probability close to P (i.e., between P and 10 P). Then we say that one event occurs with probability order 1 (occurrence probability P), two events occur simultaneously with probability order 2 (occurrence probability P^), and so on. Event probability, even for dependent events, may be classified in terms of probability order. In many decision problems, knowledge of the probability orders of the significant events is sufficient to distinguish among alternatives.

48
BUSBAR-1 BUSBAR-1
LI
B1
ù
4 4
»il ei b
B2
ù
83
ù m
(I
B5
[jl ^
B?
[jl
B5 B6 87 B8
BUSBAR-2 BUSBAR-2 out for maintenariœ
Figure 3.3 Double-breaker double-bus and single-bus-single-breaker
The third example in Figure 3.4 shows a double-breaker double-bus substation with a bus tie. Normally the switch SI is open. When breakers B5, B6, and B7 are switched off for maintenance, SI is closed so that line L5 can be still in service. This puts the substation in high risk since one fault on any of the lines L4 and L5 will virtually defunct all the lines in service.
L4
BUSBAR-1 BUSBAR-1
Li
B1 m
/si
L2 L3
B5
(]
B7
[J
BUSBAR-2
L5
LI
B1 m
L2 L3
T
B5 B6 B7
BUSBAR-2
'L5
Figure 3.4 Double-breaker double-bus configuration with bus tie
»L4
The last example in Figure 3.5 shows a ring bus substation. When B4 need maintenance and is removed from the station, a single tripping of line 3 will cause the ring bus to be sectionalized into two and load 1 to be lost.

49
Line-2
Line-2
B2
4-1 Ring Bus i Line-3
Line-1
B4
Ring Bus < Line-3
Load-1
Load-1
Figure 3.5 Ring bus more vulnerable with the outage of one breaker
In this section, we illustrate in detail three categories of high-order contingencies caused by topology variation and component fault followed by one breaker failure or protection fails to trip, and we give a concise form to calculate the probability of these events by tracing the topology of system. We use an example to explain our approach.
3.2.1 Graph Representations of Power System Topology with Substation Model
Formally, a graph G = (F, E) is defined by an ordered pair of finite sets K and E, where the elements in F are called the Vertices (also called nodes or points) and the elements in E are called edges (also called sides or arc) [54][55][56]. Each element in E is a subset of F containing only two element of F. For example a=(r
, E
)=({r„ v lt v,},
K ) ,
2
v,), e , = ( v 2 , r
3
)})
.n defines the triangle graph in Figure 3.6 with {P|, constituting its three vertices and
=(%, E%=(^, E;=(^, F,)} constituting its three edges.

50
Ei
Figure 3.6 A graph with three vertices and three edges
There are a number of applications of graph theory to power systems:
-4» The graph used in circuit theory, where a graph vertex is defined to be a voltage node and a graph edge is an impedance branch.
The graph used for power flow, where a graph vertex is defined to be a voltage bus and a graph edge is a transmission lines or a transformer.
The graph used for EMS to represent the connective of power system components, i.e. generators, lines, transformers, bus section, breakers, switches, and loads, where a graph is defined to be a bus section and a graph is any other component.
The first two graphs are familiar to power system engineers. The third one used in EMS may not be as straightforward. We will introduce EMS graph model for power system topology first. Then we will use an example to derive a new form of graph modeling the functional groups in power systems based on EMS graph model.
The one-line diagram in Figure 3.4 shows part of a real power system with bus bar segment BS-6 out for maintenance. Every component is tagged with a unique ID. Each of the components other than a bus section connects two different bus sections. In reality not all non-bus-section components are joined by two bus bars, in this case we simply insert a bus section between two non-bus-section components. This ensures our data format for the topology of the power system is the same as those in EMS. A bus section is connected by one or more other types of components. If we take all the breakers and open switches (which form a cut set) away from the diagram, the whole diagram is decomposed into seven isolated parts. Each of the isolated parts is contained within a dashed circle. The components contained in each dashed circle of Figure 3.4 form a /w/icfiona/ group which we defined earlier in this chapter. A functional group does not include any circuit breaker and open

51 switch, which forms the interface between two different functional groups. Generally, there is only one interfacing component, a breaker or a switch, connecting two functional groups.
One convenient way to model the system is depicted in the right hand side of Figure 3.8.
In this figure, the components are unanimously modeled as vertices. Each ellipse corresponds to a real power system component. The edges only show how the component are connected but do not correspond to any real component. The functional groups are identified with dashed circles as in the one-line diagram in Figure 3.7, and each one is assigned a label FG - i. The interfacing components between each functional group are indicated with a grey ellipse, i.e., components BR-1, BR-2, BR-3, SW-2, and SW-3.
LN-2
GROUND legend
IS: Bus Section
BR: Breaker
G: Generator
CAP: Capacitor
SW: Switch
LN: Line
TR: Transformer
FG: Functional Group
Figure 3.7 One-line diagram of actual system illustrating functional groups
1
—if""/-"'
Legend
BS: Bus Section
BR: Breaker
G: Generator
CAP: Capacitor
SW: Switch
LN: Line
TR: Transformer
FG: Functional Group
FG: Functional Group
Figure 3.8 Two graph representation of Figure 3.7
5G-7

52
The graph model used in some EMS is not as that in the left hand side of Figure 3.8, rather it models the topology as the graph shown in the right hand side of Figure 3.8. This model is different in that both a vertex and an edge correspond to a real component. It treats all bus section components as vertex and all non bus-section components as edges. Each vertex of the graph corresponds to a bus section component in the power system. The edges indicate how the bus sections are connected. Each edge corresponds to a non-bus section component (line, breaker, capacitor, generator, and switches). A bus section component may be connected by more than two edges, while each edge connects only two vertices. The functional groups are again identified with dashed circles, and each one is assigned a labelFG-f. The interfacing components between each functional group are the same as in
Figure 3 .8, but they are modeled as edges instead of vertex. This graph is undirected which is different from the directed graph model in electrical circuit analysis and power flow. The graph for them is directed because they need a reference direction for electric current flow or power flow.
In order to facilitate reference in later part of this chapter, we list all the components, vertices, or edges, in Table 3.3 and Table 3.2. We assign each component a number I.D. in addition to the name I.D. The expressions and are three different reliability indices defined for power system components. is the probability that component has a ground fault contingency and means the probability that the component fails and has to be forced out from operation. Since fault contingency is only one of different modes of failure, must be greater than or equal to is called ^er demaWJb;/ i.e. the conditional probability that the component fails to perform an action when the component is demanded to perform that action. Not all components need all the three reliability indices. Both ^ and are defined for non bus-section and non switchingcomponents because these components have many failure modes in addition to ground fault.
Since these components are stagnant devices that do not receive any command from control and perform any action, they do not have an ^ index. Only is defined for bus sections since they are stagnant and fault is virtually the only possible failure mode for them. Only is defined for switching components (breakers and switches) as they receive command

53 from protection relay to connect or disconnect actions. Although it is possible for a switch component to have ground fault or other mode of failure, we transfer this probability to that of the two components the switch component connects by increasing the ^ and . The value of depends on the switching status of the component. If the component is already in OPEN (or OFF) state, then ^ is zero, otherwise, it is the conditional probability that the component fails to open when required.
Since each functional group is tripped by protection relay as a whole entity, any fault or failure of a component within the group will cause the whole group to be tripped. The probability a functional group is tripped can be calculated as , where the elements of ieSj are the indices of all the components in functional group i. The probability a functional group is tripped due to fault can be calculated as in the same way.
The equations for each individual group are summarized in the last two columns of Table
3.4.We assume the availability of the connection data for each power substation and the components within and between them, as summarized in the 3rd and 4th columns of Table
3.3. We perform a graph search [54], using this information to identify the functional groups.
The results of this search for this example are provided in the first four columns of Table 3.4.
The fifth column of Table 3.4 provides the failure probabilities of the functional groups, which are the summation of the failure probabilities of the non-interfacing components comprising the functional group.
Name I.D.
Table 3.2 List of vertex component of the power system diagram in Figure 3.7
BS-1 83-2 BS-3 BS-4 BS-5 BS-6 BS-7 BS-8 BS-9 BS-10
Number
Fault Prob.
17 p,7
1
FT
18 pi 8
FT
19 20 p20
FT
21 22 pzz ffT
23 24 p24
FT
25 nZ5
FT
26

54
Tab] e 3.3 List of edge components for the power system diagram in Figure 3.7
Name I.D. No I.D.
Connected
Bus Sections
Status
Probability from To Fault Fail Per Demand
G-l
LN-1
LN-2
LN-3
LN-4
UN-5
TR-1
CAP-1
BR-1
BR-2
BR-3
BR-4
SW-1
SW-2
SW-3
SW-4 l
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
BS-1
BS-5
BS-6
BS-8
BS-9
BS-10
BS-2
BS-4
BS-1
BS-3
BS-4
BS-9
BS-4
BS-6
BS-7
BS-8
Ground other system other system other system other system other system
BS-3
Ground
BS-2
BS-4
BS-5
BS-10
BS-6
BS-7
BS-8
BS-9
On
On
On
On
On
Off
Off
On
Online
Online
Online
Online
Online
Online
Online
Online
PfT p3
FT
0
0
0
0
0
R
P
5
R
P
5 p
6
R
FT
P'rr
0
0
0
Pk
Pk
0
0
0
0
0
Pk
0
0
0
—
—
—
—
—
—
—
— p
9
T
PD pio
PD
P
N
PD pi 2
PD pB
R
PD pM
R
PD
FG-1
FG-2
FG-3
F&4
FG-5
FG-6
FG-7
Table 3.4 List of functional groups and identified their failure probabilities
Interfacing
Components
(breaker or
Open switch)
Per Demand
Fail Prob. Of
Interfacing
Components
Fault/Failure Prob. of
Functional groups
Fault:
Failure:
BR-1
BR-1, BR-2
BR-2, BR-3,
SW-2
BR-3
SW-2, SW-3
SW-3, BR-4
BR-4 p*
PD p9 pIO
1
PD *
1
PD p]0 pll r
PD ' PD pu pi" pis
1
PD I
1
PD pi 5 pi 2
PD '
1
PD p!2
PD
- {1,17}
= {7,18,19}
^3 = {8, 20,
13, 22, 3}
^={2,21}
S, = {23}
^« = {24,4,
16, 25, 5}
S,
= {26, 6}
Z ^
Ml,17} z ^ ie{7,18,!9>
Z &
>e{8, 20,13,22,3}
Z
'€{2,21}
Z ^
'e{23)
Z
MM, 4,16,25,5} z &
«*<26,6) z & z ^
îe{7,18,19} z &
«€{8,20,13, 22,3}
Z fe{2,21} z & k(23) z &
/e{24, 4,16, 25,5}
Z
«€{26,6}

55
A careful observation of shows that it can be reduced to the smaller graph in Figure 3.9, if we take each functional group as a vertex in graph theory, and any component (a breaker or an open switch) between two functional groups as an edge. If we define (FG - ;, FG- y) to be the component j oining FG - ; and FG -y, the new graph can be express by
G = (%, F) where % = {FG-1, FG-2, FG-3, FG-4, FG-5, FG-7, FG-7} and F = {(FG-1, FG-2), (FG-2, FG-3), (FG-3, FG-4), (FG-3, FG-5),
(FG-5,FG-6), (FG-6, FG-7)}
= {aa-i, aa-2, aa-3, ,w-2, ,w-3, aa-4}
Figure 3.9 shows the graph defined by G = (%, F).
Functional Group
Open Svvtch
Breaker
Figure 3.9 Reduced functional group graph for Figure 3.8
Since the graph is an undirected graph, we define the pairs in F as exchangeable, i.e.
(FG - ;, FG - ;) = (FG - FG - ;).
The results of the graph search also enable identification of the interconnections between functional groups, as summarized in Table 3.4. Each column in the table corresponds a functional group, while each row corresponds an interfacing component. There are two ones in each row, which indicate the interfacing component joint the two corresponding functional groups. The rest of the elements are all zeros.

56
—
BR-1
BR-2
BR-3
SW-2
SW-3
BR-4
Table 3.5 Connections for the interfacing components and the functional group
(1- connected, 0-not connected)
FG-1 FG-2 FG-3 FG-4 FG-5 FG-6 FG-7
1 1 0 0 0 0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
1
1
0
0
0
0
0
1
0
0
1
1
0
0
0
1
1
0
0
0
0
1
The array of elements in Table 3.5 can be represented via a matrix B in equation (3.2), where each row of B corresponds to an interfacing component, and each column corresponds to a functional group. This matrix is also called incidence matrix in graph theory [55][57].
^1 1 0 0 0 0 0^
0 1 1 0 0 0 0 a
0 0 1 1 0 0 0
0 0 10 10 0
(3.2)
0 0 0 0 1 1 0 j) 0 0 0 0 1 ly
If a component within either of the neighboring functional groups FG-z and FGy has a fault and the breaker connecting FG-z and FG^ fails to open, generally, all the components in the two neighboring functional groups will be taken out of service. The probability that the functional group G, and G/ both fail during the time interval At can be expressed as: f
P D h e S j u S i
F T
E fA + E fA k e S j
0 3 ) where is the index of the interfacing component that jointing functional group ; and functional group y. active failure rate (failure to open as required) of the interconnecting components between functional groups G, and G, (given by the failure rate of the

57 interconnecting component), At is the next time interval considered, and P* is the sum of the failure probabilities of all components in functional groups G, and Gy.
The last column of Table 3.3 provides the per demand failure probabilities of the interfacing components. We denote the vector of failure rates of interfacing component as where and the
D = 7%, 7%) (3.4) indicates a square matrix having diagonal elements equal to the argument of function and zeros elsewhere. The index of each 7%%, is the same as the index of the interfacing component.
Then all the equations in form of equation (3.3) can be summarized in matrix form as:
^BQ
P
SBC
3
^SBQ
P
5 p
P23
Pu
P* p
56
1
PD
0
0 0 0 0 0 ^ pio
PD
0 0 0 0
0
0
0
0
0
0
P u
0
0
0 0 0 n!4
PD
0 0
0 pis
1
PD
0
1° 0 0 0 0 p!2
PD
J
( p F T \
1 1 0 0 0 0 0^ DfT
0 1 1 0 0 0 0 pfT fg
3
0 0 1 1 0 0 0
0 0 1 0 1 0 0
0 0 0 0 1 1 0
0 0 0 0 0 1
1 f g
3 pfr
^FG« pfT
(3.5) or
,FT
FG
(3.6) where
' SBC ' SBC; ' ^ .SBC, »
'SBC,' Ps r
— (^12: ^23» ^34' ^35'
D is given by equation (3.4),
'56'
^ is given by equation (3.2),
'SBCL
(3.7)

58
FC, »
As we mentioned previously, SW-2 and SW-3 are open, so it is not possible for the two switches to fail to open. We set ^ and 7^ zeroes to model this situation.
Although equations (3.5) and (3.6) give a concise mathematical form to calculate the probabilities of breaker-stuck contingencies, it depends on the availability of matrix B, which is not easy to obtain. In addition, the size of Z? is very l&qge and sparsity technology has to be used to handle it efficiently. Subsection 3.2.3 will introduce a computer algorithm to search for functional groups and a method to get the breaker-stuck contingencies without formulating the 2? matrix.
3.2.2 Some Anomalies in Functional Graph Decomposition
We discuss two abnormal situations in the functional decomposition of power systems:
1) There are two breakers between two functional groups;
2) A breaker or an open switch joins one functional group instead of two.
In some cases, in order to make sure the power supply is not interrupted by breaker maintenance, utilities use two breakers that operate in parallel. For example, there are a few cases in the single line diagram of the IEEE one-area RTS-96 substation system [50].
The following figure shows one of such cases
Brë'aker-â
Load
Functional Group 1 Functional Group 2
Figure 3.10 Two breakers acting as backup of each other
(Excerpt from IEEE RTS-96 [50])
In term of graph representation, it is easy to model this situation. It is just equivalent to the case where there are more than one edge between two vertices. This type of graph is calledp-graph, whereis the maximum number of edges between two vertices. We just need to add one more row in ^-matrix to indicate another breaker is also joining the two

59 functional groups. The difficulty related to this anomaly lies in the computation of the probability of stuck breaker probability. One way to avoid confusion is to model the two breakers as one. Their aggregated per JemaWcan calculated as follows:
P(6reo&erl afwct or 6reo&gr 2 jfwc&) = P(6rea&erl ^fwct) + f (AreoAer 2 jfwct) —
F(6reaterl and Areoter 2 gfwcA:)
The other way to address this difficulty is to model them separately, i.e. to treat the stuck breaker trips due to breaker-1 and breaker-2 as two different contingencies. In this case, the forms of equations (3.5) and (3 .6) is not changed.
Another anomaly is that a breaker or an open switch joins one functional group instead of two. The Figure 3.11 below shows a case taken from the single line diagram of IEEE onearea RTS-96 substation system [50], where the two functional groups joined by the breaker
B-2 are actually the same one. We omitted the switches since they are all closed and will not effect on the analysis. This is equivalent to the case in graph theory where one edge starts from one vertex and ends in the same vertex. This edge is called a ring in graph theory [55].
The corresponding row in the ^-matrix defined in (3.2) has one unit element and other elements in the rows are all zeros. The stuck breaker contingency that corresponds to breaker
B-2 is trivial in this case since it does not have any influence on the clearance of fault whether it opens or closes.
As to the abnormality that an open switch joints one functional group instead of two, we have not found any in all test and real systems we know. However, we do not exclude the possibility that there are such cases in a real power system. If it does exist, we can use the same approach as we showed in the above paragraph.
Load
To Other Part ofBUS-19
Functional Grpup
Figure 3.11 Breaker B-2 connects one rather than two functional groups
L-37

60
In a summary, we have discussed some anomalies when decomposing the power system topology into functional groups. These anomalies can be modeled as a p-graph with ring(s).
A sample of such kind of graph is shown in Figure 3.12, where there are two edges (&/ and
&2) between vertex PV and P2 and the ring &S starts from F2 and ends in P2 also. The formula (3.6) is still valid for all these anomalies, however special attention must be taken in computing the probabilities of stuck breaker contingencies for the breakers that cause these anomalies.
El
Figure 3.12 A p-graph with a ring
3.2 J Algorithm to Searching fnr Topology for Contingencies
If we have decomposed the topology of a power system into functional units, the identification of simultaneous #-t(k>l) primary contingencies is quite easy. As we indicted in Table 3.4: any single fault will result in a removal of all the components in the functional group, within which die fault occurs; if any component within the group fails for reasons other than fault and need to be removed from the system, then again, all the component within the group have to be removed. The reason we distinguish between the two situations is that we use the fault/isolate probability of a functional group to derive the fault/stuck breaker probability of &BC 's.
Any single fault plus breaker failure will cause the removal of all the components in two neighboring functional groups within which the fault occurs such that the interface between the two functional groups is the failed breaker. If we assume a fault is specified by only the component on which it occurs (and not where on that component it concurs), then there is a one to one correspondence between each fault/failure initiated contingency and each closed breaker.
We have not identified how to find ITC contingencies and their probabilities. To identify
ITC contingencies from the power system topology, we need to identify the voltage bus first.

61
This will be covered in Subsection 0. The probability of an ITC contingency A that involved line i and line y can be calculated by
= Pr(/me i fnpj)Pr(/mg y
Pr(/mg y fr^pa)Pr(/;»e %
Data Structure to Represent System Topology
; fr^) + y frzp?)
Any EMS database stores a large amount of information for each power system component including how the component is connected together. We do not need all of this information to process power system topology. The information needed for functional group decomposition does not take much memory as it takes the form of data linkage rather than the B-matrix of (3.2). The minimal information we use to do functional group decomposition for each individual component is as follows.
1) Transformer/Line components
4- Component I.D.: the name or index of the transformer/line.
4- Starting Bus Section I.D. : the first bus section to which the transformer/line is connected.
4- Ending Bus Section ID.: the second bus section to which the transformer/line is connected.
2) Generator/Load/Shunt components
V Component I.D. : the name or index of the generator/line/shunt.
Bus Section I.D.: the bus section to which the generator/line/shunt is connected.
3) Breaker and switch components
4- Component I.D. : the name or index of the breaker/switch.
Starting Bus Section I.D.: the first bus section to which the breaker/switch is connected.
Ending Bus Section I.D. : the second bus section to which the breaker/switch is connected.
-4- ON/OFF status flag: the flag showing if the breaker/switch is turned on or off.
4) Bus section components
4- Component I.D.: the name of the bus section.

62
In order to store the search results, we also need to reserve some following fields in each component object in computer program:
4- For each non-interfacing component, i.e. line, transformer, breaker, shunt, bus section, and load, reserve one field to store the pointer that is pointing to the functional group to which the component belongs.
For each interfacing component, i.e. breaker and switch, reserve two fields to store the pointers to the two functional groups the component bridges.
Each functional group object contains a W data structure that stores all the components the functional group contains. It also contains a list of all interfacing components it borders.
Decompose a Power System into Functional Groups
This is the core of the computer program to identify high-order primary contingencies. As a common practice, we model the one-line diagram of power systems as a graph, in which the vertices represent any bus section components and edges represent lines, transformers, generators, switches, breakers, shunts, or loads connecting two bus sections (we model ground as a special bus section). The algorithm we used to decompose the power system into functional groups is graph search. Although many textbooks provide standard method to search in a graph [55], the algorithm we need for decomposition is not readily available.
Our algorithm can be summarized as follows:
1. Begin of decomposition;
2. virAifrari^ cAoose one wnvisifecf verfez (tws secfioy%) a* a sfarfing component fsfaMisA a mew e/npfyybncfiona/ group oA/ecf wi/Aowf any component in if/
4. fAe cAosen jecfzon fo fAe Jbncfiona/ group o6/ecf as ^zrsf component
J. Aorfzng/rom fAk verfex, me^e fAeywncffona/group's immecAafe neigAAoring component info fAe group an^ ZaAe/ fAem as vûife</;
7%e sfg? 2 continues unfi/ fAe group eapandk fo ik Aordkr, wAere fAe Zwrt/ering conyonenA are a// Area&ers a%/ open swifcAes;
7. T^a// component in fAe power sysfem are visited stop searcAing ancf go fo fAe /asf sfep; e/se cAoose anofAer unvisifet/ Aus secfion angf refum fo sfep 2 a// over again;
& fw/ o/^ dlecomposifion.

63
The searching algorithm from step 2 to step 4 is actually a typical (Breadth-first search) in graph theory. The ZfFS graph search uses a gwewe data structure to temporary store the indices of unvisited components. A queue is a special list data structure. Its elements are linked one by one linearly like that of list data structure, but it restricts the removal of old element to one end of the list and the addition of new elements only to the other end of the list. This feature is usually called Grst-in-Grst-out (fTFO). We use some special symbols to represent the data structures in our algorithm They are explained as follows: g User defined stack data structure. Its elements are power system components;
FCL, List data structure that stores all the components within the functional group ; z j
The index of functional group
The index of bus sections w Index of components in one functional group w Current component for searching
The detailed algorithm to decompose a power system into functional group is described as follows
1)label all the components as 'unvisited'
2)indexFG<- 0, indexBS <— 0: initialize indices
3)loop~0; loop through all the unvisited bus sections
4) FIFO <— Null: clear FIFO link list indexASt- ifK/g%&S+7: TVbte tAe a&zrfiMg component a/wqya &e a 6%; section component
# iWe%fG=indgxFCr+7 if tAe Aw: section in(&%5^ k vifite^ it » not tAe fast Awj section in tAe jwwer system consi(&re^ repeat step J en<6f
70) iftAe Auy section indlsd)^ » viyzta/ ancf it û tAe /axt tAe Aws section in tAe/xwer Ayftem consiakre^ tAen en(7
77^ en^if
72) /ate/ Aug section
7J^ ocW (o TWO ay visited
14) add I
$$jnclexBS
F G indexFG
15) loop-1: While FIFO!~null,

64
7(%) « pop orne e/emenf^"om fTFO
/
7&)
/%)
20)
21)
22^
23)
24)
25)
/oop-2. yôr eocA w fAaf i? immaAafe nezgAAors of w ifw û Mon-mfe^cing co/MpoweMf, f&en w fo FG,*tiFG
We/ os v»:W if w is unvisited then Add w to FIFO eWif else if w is breaker or open switches if w's starting functional group is null then w's starting functional group
<—
F'Gi„
Jex
,-
G
;
26)
2
2g) else ifw's ending functional group is null then w 's emAmg^mcdoma/ growp <- FGworc
29) endif
30) end of I oop-2
31) end of loop-1
32) end ofloop-0
33) end of FG-decomposition
The algorithm for graph search can be found in any computer textbook on algorithm and data structure [54]. Our algorithm uses the basic idea described in [54]. However, our algorithm is very refined and tailored for actual power systems. For example, the algorithm does not arbitrarily choose any component to begin the search for the functional group. It starts the search from the bus section component only. This is because a functional group contains at least one bus section, so this choice will make assure that no functional group will be missed. During the searching process for any functional group, the algorithm assigns the functional group's pointer (physical memory address) to the corresponding Geld of the interfacing component object and stop search in that direction. In that case each interfacing component will be assigned two pointers pointing to the two functional groups it bridges.
Decompose in Updating Mode
The topology of a power system actually does not vary frequently and whenever there is such change, it usually happens locally and involves only a few components. We need not run the full search algorithm periodically as long as there is no switch operation within the system. Whenever there is a switch operation, we can make the corresponding changes to

65 the decomposition incrementally rather than perform a complete graph search for the entire system.
The four basic switching operations that change the connectivity of a power system are:
7^ open a
2^ c/ayg a fwr» on o fwffcA a awifcA
Any other topology changes are actually one or a combination of the four basic switching actions. For examples, a line tripping is usually the result of two or more breaker-opening actions and a generator tripping is the result of one or more breaker opening action.
Turning on/off a breaker actually does not change the way a power system is decomposed. It only changes the probability of the stuck-breaker contingency for the contingency the breaker is associated with. If only one breaker is switched of% that means it is no longer possible to have a stuck breaker contingency that involves both functional groups the breaker connects, however the two functional groups are still there unchanged. The same rationale applies when switching on a breaker. For example, no matter the breaker BR-2 in
Figure 3.7 is open or closed, the functional groups FG-2 and FG-3 won't have any changes.
In contrast to the case of opening and closing of breakers, turning on/off a switch do change the way a power system is decomposed. Turning on a switch will merge the two functional groups it connects into one functional group, assuming the two neighboring functional group are different. This is because a switch has no current interrupt capability as a breaker. Whenever there is a fault event, a protection relay cannot operate a switch to isolate the fault. For example, if switch SW-2 in Figure 3.7 is closed, then the two functional groups
FG-3 and FG-5 will be merged in one functional group since any fault contingencies will remove all the components within FG-3 and FG-5. On the other hand, turning off one switch may or may not make one functional group into two.
The algorithm to decompose a power system in update mode is summarized in the following steps.

66
7^ SO <— Secwg one ,nwfc&zng operation ^om
2^ zfSO « fo A/rm q^%« 6reo&er z, /Aen
3) update the state of breaker
5) e/f e if SO M fo fwm JwzfcA z, fAen switch 1 status <— OFF
6)
7)
8) rightBS <— the right bus section switch is connected with leftBS <— the left bus section switch is connected with starting from rightBS, find the functional group that contains rightBS.
9)
Denote it rightFG starting from leftBS, find the functional group that contains leftBS. Denote zf/e#FG switch i's first functional group <— rightFG 10)
11) switch i's second functional group <— leftFG
12) else if SO is to turn on switch i, then
13)
14) switch i status <— ON newFG <— switch i's first functional group LJ switch i's secondfunctional
15) groz/p switch i's first functional group <—newFG
16) switch i's second functional group <— newFG
7%) ew&f
7i%) gM<7 of tpdbfeSO.
When we decompose a power system in update mode, we update the decomposition one by one for each of the four operations listed at the beginning of this section.
Grouping Bus Sections into Voltage Buses
A voltage bus is a group of breakers, bus sections, and switches that are connected to each other. The electrical voltages of all the components in a voltage bus are equal to each other.

67
Bus sections need to be grouped into voltage buses because we need this information to identify inadvertent tripping contingencies. We carefully examined the NERC's disturbance data base and find that most of the inadvertent tripping happens to lines connected to the same voltage bus. We also need this information in performing dynamic simulation of the power system in Chapter 5 and Chapter 6 later in this dissertation. The majority of inadvertent tripping after an initiating disturbance happens close to the location where the disturbance takes place. By 'close to', we mean close electrically, that is, the voltage buses that are directly connected to the buses having a disturbance. An identified voltage bus should be stored in computer memory as an object containing the following information:
-4» All the bus sections, breakers and switches to it;
All the lines, transformer, generation, shunt, and load that are connect to it
We are not going describe the algorithm to group bus section into voltage bus because this algorithm is also used in on-line power flow and state estimation in EMS [59].
Contingencies List Generation
After a system is decomposed into functional groups and all the voltage buses are identified, the generation of contingencies list is easy. In the language of this dissertation, a contingency is not only defined by the components it removes, it is also defined by its associate probability. In accordance with this concept, a contingency as an object in the computer that contains not only the components to be removed, but also other information.
The following information (or members, if it is a C++ class) defines a contingency:
1) Type: for this research, type can be one of {FGC, SBC, ITC}
2) CList: list of all components to be isolated from the power system
3) SList: list of all switching components (breakers and switches) to be open or already open to isolate the components in 2).
4) Probabilities a. Fault Probability (FP) : defined only if the contingency is a FGC b. Isolation Probability (IP): the aggregate occurrence probability of the contingency

68
Note SList in the third bullet defines the group of switching components that are needed to isolate the contingency.
> Searching for FGC
Since we already have the list of all functional groups, we need only do some processing and export the list to a file or database.
1) Define N to be the total number offunctional groups, i is the index for junctional group FG-i
2) loop-1: For i=l to N do step 3 to step 8
4) Add all components in FG-i to the Clist of FGC j
5) Add all interfacing components in FG-i to the SList of FGC l
6) FPj<— Ppg., Ppc, is defined in Table 3.4
7) IPî 4 Ppç , Pp£ is defined in Table 3.4
8) end of loop-1
> Searching for SBC
For stuck breaker contingencies, we just need to search all the close breakers (note only closed breaker can get 'stuck') and output the two functional groups it connects.
1) Define N to be the total number of breakers, i is the index for breakers j!) De/znej fo
; < - 0
/ôr &BC,
7oop-7. For i—7 A? A^ab
J) if Greater-; « c/ofa7
J fo 77
6rgater-r /o iSBCy
7) Xdk/Areater-ffOiSBCy
6^ 7P,<—
9) M+T
7Q)
77) EW qf/oqp-7
72) 7W of X/gorifW is deGned in equation (3.5)

69
> Searching for ITC
7) A? 6g fAe (ofo/ /mmAer ofvo/kzge 6wy&;. z » fAe imtfexWfoge
2) De^we / fo 6e fAe _/br /TC ; y <-1. ; 1
4) loop-1: For / = 1 to N, do step 4) to step 16)
5)
6)
M <— number of branches (lines or transformers) connected to voltage buses i loop-2: For j = 1 to M, do step 7 to step 14
7) loop-3: For k
— j to M, do step 8 to step 13
8) add branch l and branch j to ITC.'s CList
9)
10) add the terminal breakers of branch i and branch j to lTC i
's SList lPi<— P
ITC
, P
ITC can be calculated through equation (3.8)
11) If contingency ITC j is not included in ITC list
72;
13)
74% endif end of loop-3
15) end of loop-2
7(f) ew7q/Voqp-7
17) end of Algorithm
3.2.4 Test on a Large Utility Power System
We coded the approach in C++ computer language. A full run of the program takes less than four minutes for a system topology of about 1600 buses. We believe it is possible to perform a continuous (or at least semi-continuous) tracking of the substation topology to identify these events.
The size of the utility is described in Table 3.6. Since the system is large, we first ran the program on individual small substations and IEEE-RTS 96 to verify and debug the program, and then we ran the program on the large system. The company provided us with four topologies of typical substations as well as the data files that completely describe the topology of system to the substation level from the EMS. We checked the program with each

70 substation. As a comparison, we run the program on IEEE-RTS 96 24-bus system too. The functional groups identified by program are the same as those found by inspection.
Type
No.
Table 3.6 Number of components in the utility system
Bus
1549
Line
1830
Xfmr Gen
697 353
Shunt
357
Load
1506
Switch/Breaker
10653
One problem encountered in using the EMS data is that the switch data file does not distinguish between switches and breakers. After several discussions with a utility engineer, we decided to use a number of heuristic rules to distinguish between them. However, this classification is based on experience and may occasionally cause an incorrect judgment. In the long run, the EMS database should be modified to provide the necessary fields to enable identification of breakers from switches.
Statistics of all the contingencies are shown in the following tables. Table 3.7 shows the statistics on contingencies caused by faults (no breaker failures). The first line in this table shows the number of components lost in a contingency; the second line indicates the number of such contingencies identified. Table 3.8 shows the statistics on contingencies caused by fault followed by a breaker stuck. The first line in this shows the number of components lost in the contingency; the second line indicates the number of such contingencies identified. We only count lines, transformers, generators, and shunts. Loads, switches, breakers, and bus sections are not counted.
We may see that a considerable number of functional group contingencies include more than two components. One event goes to the extreme of 11. This is most probably due to the fact that some breakers are mistakenly classified as closed switches, as we mentioned above.
Many multi-section radial circuits, which are equivalent to branch, are protected only by two terminal breakers. The program counts them as an contingency, where & is the number of segments of the radial branches. We may see that even for the contingencies that involves stuck breaker, the majority of them trip only one component. This is partly because many substations use the reliable redundant configuration such as breaker and a half configuration and partly due to the fact that we only count components that are completely disconnected. If

71 a line is only open-ended, the program still treats it as part of the system even though it is functionally not operational. k
No.
1
2022
Table 3.7 Number of functional groups
2
468
3
49
4
14
5
5
6
3
7
2
8
1
9
0
10
0
11
1 k
No.
Table 3.8 Number of fault/breaker failure contingencies
1 2 3
3011 1248 356
4 5 6 7 9 10 11 12 13 14 15 17
134 63 31 23 0 1 1 7 1 0 0 1
A full run of the program takes less than one second for a snapshot of the topology of the
1549 bus system. The computer we use is a common Dell PC with Intel Pentium II processor
(400MHz) and 384MB of RAM. This computation time does not include the time spent on reading the input data files into memory and processing the system topology into link lists, which typically takes a significantly longer time. Because a power system's topology changes are typically localized and it involves only a few components at a time, it is unnecessary to perform full topological evaluation continuously. That means if we use the updating algorithm, it would take little time. However, as we see from Table 3.9, even for system as large as 10,000 buses, it takes only a few seconds, so the significance of improvement is not that much.
System
No. of Buses
Time/Sec.
Table 3.9 Search time to identify contingencies
IEEE RTS 96 Southern System Projected Large-scale Systems
24 1,549 5,000 10,000
0.01 0.63 2.08 4.17
The selection of higher-order contingency related to system topology is investigated. The proposed approach systematically identifies three failure modes of protection related contingencies and the probabilities associated with them. The selection criteria are based on

72 rare event approximation and event tree. As a result, the total number of all possible contingencies is limited to a number linearly proportional to the scale of the system.
The proposed approach is clear and simple in nature; yet it provides an efficient contingency prescreen to capture most high-order contingencies related to protection malfunction. After this prescreen, other complicated techniques for screening and severity evaluation can be applied to these contingencies.
The contingencies we identified are not fixed. They change with the topology of system.
Therefore, a continuous tracing of a power system configuration is required. Generally, the
EMS of a power system has the function of state estimation, which includes a topology processor. Thus, the topology information is fully accessible and our approach requires no additional information beyond that. We only need to do standard graph search [54] to identify the connection matrix B in the algorithm.
Sometimes it is better to use component lost (JV-&). The term probability of the contingency. An order to classify events than the number of coMfingency does not give enough information on the contingency does not mean it has a lower probability than an JV-J contingency. While a contingency classified as probability order 2 event does not mean it would cause the lost of more than one components. It is those contingencies that occur with probability one but cause the lost of more than one component that we are particularly interested. System topology analysis propose in this chapter is a desirable tool for this purpose.

73
When estimating the risk of a power system, engineers tend to omit high-order contingencies because either these contingencies have very low probability or the number of contingencies is too large to analyze them comprehensively. In this section, we calculate the risk of high-order contingencies and compare the results with traditional jV-7 contingencies.
The risk [23] we estimate is define as
(4.1) where
Pr(C,) is contingency i.
ZA, is the forced loadsheding in order to avoid branch overloading after contingency i.
TV is the total number of contingencies to be studied.
The first step to estimate risk is to get the probabilities of contingencies. One difficulty of estimating the risk of rare events lies in that there are not so many published statistics regarding them. The NERC website [4] and reference [40] [49] [50] provides an excellent data source for our study. Most of other published reliability data is on individual power components. The IEEE reliability test system (1979 [49] and 1996 [50]) provides a summary on the reliability of each of the components for the test power system. Although the test system is not a real system, the reliability data for the test system is based on the statistics of real power systems. Since the risk we calculate is from an operational point of view, we need to convert the raw data that is usually provided on annual basis into hourly reliability data.

74
The data for generator reliability usually are MTTF (mean time to failure) and MTTR
(mean time to repair). If we assume the current condition of generator is normal and the unit for MTTF is hour, the failure probability of the generator during the next hour is
Pr(0<T<1.0) = = where T is the random variable representing the time passed until the generator fails.
The five substation configurations discussed in this dissertation are taken from [60]. AH calculations assume that none of the substation components are in maintenance or out of service for any reason before a contingency. Furthermore, all the five configurations have four out-going or incoming connection points, so the apparent functions of them are the same: serving as a hub to join four branches. In terms of contingencies, the performances of all five configurations are the same. If any line has a fault and it is tripped correctly, all the three other lines will be still functional. 7%e d^ererzce /:es i» f&af f&e;r roAwsfMe&y fo Aig/z order coMfrngeMcfes. Some substations are obviously more reliable than others for highorder contingencies, for example, the double-bus-double-breaker (DBDB) configuration is more reliable than the single-bus-single-breaker (SBSB) configuration in Figure 4.1. A bus fault outage can defunct all the four lines from/to the SB SB station while the DBDB station can withstand such a disturbance without interrupting the service to any of the four lines.
Usually, power system engineers study the reliability of substation using state diagram with
Markov model or Monte Carlo method [37][38][39]. The full state diagram is not practical for a substation with many components. In this case, many simplifications have to be made so that the approach is feasible. Our approach provides a new way to study substation reliability and the algorithm is not restricted by the number of components in a substation.
We use our graphic functional group model described in the previous chapter to analyze the reliability of the five basic substations.

75
H Y
Single Bus Connected with Bus Tie (SB-TL)
Ring Bus
(RB)
H H i
M M î V
Double Breaker and
Double Bus (DB-DB)
Single Breaker-Single
Bus (SB-SB)
Breaker and a Half Bus
(B-HB)
Figure 4.1 Five typical substation configurations
Some of the notations used in next section are defined below:
FS#, : contingency caused by fault plus breaker ; stuck;
: failure probability of bus section z. It is assumed to be zero for this discussion, i.e.,
^ = 0 for all z;
: conditional stuck probability (per demand failure rate) of breaker ;. It is assumed
D : diagonal matrix whose elements are ^'s; pL : fault probability of line z . It is assumed to be the same (denoted as # ) for all transmission lines;
Z? : connection matrix of all function groups in a substation. Its elements are defined in equation (3.2);
FG - z : functional group z ;
Ppc : fault probability of the z'* functional group;
: column vector representing the fault probabilities of all functional groups;

76
* : the aggregate probability of a group of contingencies caused by a fault within any of the two neighboring functional groups of breaker z and followed by the stuck failure of breaker z. The fault could happen on either side of the breaker. It could be a single line outage as well as a multiple line outage.
: column vector made up of , the length of the vector is the same as the number of breaker in the study case;
: serve as a measurement for the consequence of contingency . We use a simple linear index to evaluate consequences: the consequence is equal to the number of lines lost in each contingency;
C,%g : row vector representing 's;
: risk of fault stuck-breaker contingencies.
4.3.1 Single Breaker and Single Bus (SB-SB)
This configuration is simple and straightforward. From Figure 4.2, there are a total of five functional groups and four breakers, implying four stuck breaker contingencies. The B-matrix representing the connectivity of the four functional groups is shown in the right side of
Figure 4.2. Clearly, with this single-bus-single-breaker substation diagram, any stuck breaker failure will cause the lost of all the four lines. The functional group fault probability, which is the summation of the fault probability of each component in the functional group, is calculated from equation (4.3), assuming the failure probability of bus ^ = 0.
FG-4
Une-4
/'—R%3
/ Line-3 \
'1 1 0 0 (f
10 10 0
10 0 10
,1 0 0 0 1,
Line-l
Line-2
Figure 4.2 Single breaker single bus substation and its ^-matrix

77 ffŒ-4) (4
^FG " f^FG' .PfG' f FG' PfG» ^FG ) f
D = dzog(^, p^, A&J (4-4)
With D, ffc known, the probabilities of all the stuck breaker contingencies can be calculated by
PpSB
=
D x B x
P
FG
/
=
\r
A + A , f t + A , P& + A )
(4 5)
Since the consequence of all stuck breaker contingencies are the removal of all four lines, the C,%g is just a row vector consist of four 4's as in (4.6). The total probability of having a fault plus stuck breaker contingency in the SB-SB substation is ][PfSB_;=4
^FSB = ( C
1 »
C FSB-
2 >
C FSB-
3 >
C FSB-
4 )
= (4, 4, 4, 4)
Then the risk of the substation is calculated as
R I S K
S B
_
S B
— C
F S B x P
FSB
— 16 x p sb x p y.
4J.2 Rinp Riis
,, _
(4.6)
(4.7)
This configuration is simple and straightforward too. From Figure 4.3, there are a total of four functional groups and four breakers. The ^-matrix representing the connectivity of the four functional groups is shown in the right side of Figure 4.3. With this ring bus configuration, any stuck breaker failure will outage at most two lines. The functional group fault probability is calculated as from equation (4.9), assuming the failure probability of bus
P y - 0 -

78
Une<3
Line-2 f
1
0
1 0 ol
1 1
0 0 1
1 0 0 1
Figure 4.3 Ring bus substation and its 5-matrix
^FSB ~
(
^FSB-i
»
PfSB-2 • ^FSB-l
'
F'FSB-A
) (4-8)
PpG ~ {PpG> ^FC '
= (?„ f/, f/,
D = d;og(^, f^,,) (4.10)
With D, B, fpc known, the probabilities of all the stuck breaker contingencies can be calculated by
— D x B x
( 4 11)
= 2^, 2p„ 2^)
Since the consequence of all stuck breaker contingencies are removal of all four lines, the
Cj%g is just a row vector consist of four 2's as in (4.12) and the probability of having a fault plus stuck breaker contingency for the ring bus station is
Cf3B " (CfSB, )
CfSB, )
Then the risk of the substation is calculated as x — 1 6 x x
4.33 SingleJBnsCqnncct^w^^
(4.12)
( 4 1 3 )
This configuration SB-TL in Figure 4.4 is adapted from SB-SB by splitting the bus and adding a tie-breaker between the two buses. When any of breakers 1-4 get stuck, only two lines will be lost at most. Note we assume Bus-1 and Bus-2 will never have a fault (p,&=0), so it does not matter whether Breaker-5 gets stuck or not. The B-matrix representing the connectivity of

79 the four functional groups is shown in the right side of Figure 4.4. The functional group fault probability is calculated as from (4.15), assuming the failure probability of bus = 0.
Pf5g-2' ff33-3' f ) (4.14)
P FG ~ ( P F G •> Pre
'
PFG ? P FC , ' P FC •> PFG)
- ( # ; f/» f/» P;» A» f / )
D = =
(4.15)
(4.16)
Bus-1
V Line-1
FG-1
BR-5 /
Bus-2
IS IB
"""'X iW} u
"6"
4
^3 FG-4
/I 0 0 0 0 1
0 1 0 0 0 1
B = 0 0 10 10
0 0 0 1 1 0
V
0 0 0 0 1 1
Figure 4.4 Single bus connected with tie breaker and its B-matrix
With D, jB, and known, the probabilities of all the stuck breaker contingencies can be calculated by
= D x ^ x ^ = ^ x ( ^ „ 0 ) ^ (4.17)
The consequence of all stuck breaker contingencies is removal of all four lines, the is a row vector consisting of four 2's as in (4.18). The probability of having a fault plus stuck breaker contingency for the SB-TL substation is
\f5B-2»
= (2, 2, 2, 2, 4)
Then the risk of the substation is calculated as
—Cfgg x = 8 x x
4j.4 ppubleBrcakerandDqu^
)
(4.18)
(4.19)
From Figure 4.5, there are a total of six functional groups and eight breakers, much more than all other types of substations. The ^-matrix representing the connectivity of the four

80 functional groups is shown in the right side of Figure 4.5. With this DB-DB configuration, any stuck breaker failure outages at most one line. The functional group fault probabilities are calculated from (4.21), assuming the failure probability of bus f y = 0.
BfN
-FG?-
BR-7 hBR-
BR-1U BR-2 BR-aJBR
P6-6-
Bus-2
B
0
1
0
0
0
1
0
0
1
0
0
0
0
0
0
1
Figure 4.5 Double breaker and double bus and its 5-matrix
PPSB - { P FSB-V P FSB-3 '
P
FSB4' P FSB-5 '
P
FSB 6 '
P
FSB 7 ' P FSB-S )
(4.20)
^
FG =
( P
FC '
P
FG >
P
FG > P
FG '
P
FG •>
P
FG )
= ( # , A , f / , A , 0, 0 )
(4.21)
# = = A t , A t , A t ) (4.22)
With D, 5, Pfc known, the probabilities of all the stuck breaker contingencies can be calculated by
— Z) x B x
(4.23)
— ^ ( f y » P y Py» f y P y P y P y f y )
Since the consequence of all stuck breaker contingencies is the removal of a line, the is a row vector consisting of four I's as in (4.24). The probability of having a fault plus stuck breaker contingency for DB-DB substation is fgg-r# Among all fault plus stuck breaker contingencies, none of them involves more than one line.
Qg;
Cf3_2,
=(1, 1, 1, 1, 1, 1, 1, 1, 1)
Cpgg_g,
Then the risk of the substation is calculated as
4^-7'
(4.24)

81
(4.25)
4.3.5 Breaker and a Half R" s (R-TTR1
From Figure 4.6, there are a total of six functional groups and six breakers. The B-matrix representing the connectivity of the four functional groups is shown in the right side of Figure
4.6. With this B-HB configuration, any stuck breaker failure will outage at most two lines.
The functional group fault probabilities are calculated from equation (4.10), assuming the failure probability of bus = 0. tine-2
1
""FG-3gy&l.
$
FG-4
/Lhe-3 y tine-4
FG-i, $_1
FG-5
Bus-2 g =
^ 1 0 0 0 0 1
1 1 0 0 0 0
0 1 1 0 0 0
0 0 1 1 0 0
0 0 0 1 1 0
0 0 0 0 1 1
Figure 4.6 Breaker and a half bus and its 5-matrix
!
FSB
" ( P
FSB
- ]
'
P
FSB-2
'
P
FSB-3
'
P
FSB-4' P FSB-4 '
^RC
\T
~ ( P
FC
'
P
FG
>
P
FG
>
P
FG
'
P
FG
>
P
FG )
= ( f „ A , 0, P;, 0 /
(4.26)
(4.27)
At» A t , ) —(At, A t ; At» Pj»; A t ; A t ) (4.28)
With D, Pfc known, the probabilities of all the stuck breaker contingencies can be calculated by
^fS6 — Z) X ^ X
(4.29)
= A t * ( A t , ^ A t , A t , A t , 2p;t, A t )
The stuck of breaker 2 and breaker 5 will cause the removal of two lines while other breaker stuck will cause the outage of only one line. The probability of having a fault plus

82 stuck breaker contingency is ^f3g-,=72 xp,& Among all fault plus stuck breaker contingencies, only the stuck of breaker 2 or breaker 5 could involve more than one line.
^FSB ~{
C
FSB1'
C
FSB2'
C
FSB3'
C
FSB4>
C
FSB5'
C
FSB-6 )
= (1, 2, 1, 1, 2, 1)
Then the risk of the substation is calculated as
X
= 12
X ^
4J.6 Summary
,,
(4.30)
(4.31)
Table 4.1 gives a summary of the topological analysis results for the stuck breaker contingencies. Because the SB-SB configuration has a smaller probability of having a stuck breaker contingency (compared with ring bus) and higher consequences (compared with ring bus), the ring bus and the single bus single breaker configuration has the same
That does not mean ring bus have no advantage. It hedges the risk of high-order contingencies by containing them to involving only two without adding more breakers, which is very expensive, although with the cost of more complex protection scheme. The SB-TL and DB-DB schemes have also the same risk index, but DB-DB uses eight breakers while SB-TL uses only 5. The advantage of DB-DB lies in the fact it considerably reduces the possibility of multiple contingencies. A fault and stuck breaker failure just cannot cause a contingency that trips more than one line. The B-BH scheme seems to have no advantage compared with SB-TL. It takes more breakers while has a higher risk than SB-TL. The probability of having N-2 is also the same as SB-TL, so there no improvement at all.
One conclusion from this analysis is that increasing the number of breakers also increases the possibility of stuck breaker failure. Increasing the number of breakers does not necessarily results in improveed reliability.
The analysis of typical substation schemes in this section is just a rough estimation and has many assumptions. We use a linear consequence measurement here. The consequence of an jV-2 contingency may be more than doubled to that of an JV-7 contingency. In practice, it is possible that an #-2 contingency means collapse of system, while an AW means no impact at all to a system. In addition, maintenance related benefits are not considered in this study, which may play a significant role in the design of substation. For example, although the B-HB does

83 not provide advantage in defending high-order contingencies, the operator does not need to outage any line when breakers need maintenance.
Substation
Type
Table 4.1 The probability and risk of high-order contingency for different substations
Risk
Prob.
(Fault plus
Stuck breaker)
Prob.
(#-*, t=22) number of breakers
Fault plus stuck breaker
Contingency set*
4
FG; and FG
S
, FG
2 and FG
S
. FG_, and FG
5
, FG
4 and FG?
The risk of this configuration is the highest. Although the probability of having 2 or more circuits out is not as high as the ring bus, once the event occurs, it will take out all the four out-going lines.
4
FG7 (WFG2, FG2 aWFGJ, FG3 and FG4. FG4 and FG1
The probability of high-order events is the highest for the ring bus station.
5
FG7 aWFGJ, FG2 ow/FGJ, fW and FG6, FG3 and FG6, FG4 and
FG6
This configuration has the same risk index as DB-DB, but it needs only five breakers, while the DB-DB needs eight.
0 8
FG7 awfFGJ, oWFGJ, FGj andFG5, FG4 and FG5, FG1 and
FG6, FG2 and FG6, FG3 and FG6,
FG4 and FG6
No doubt DB-DB is the most reliable configuration. Outage of any two circuits needs one line fault and two breaker failures, which is a probability order 3 event and whose probability is negligible compared with probability order 2.
6 and FG4, FG4 and FG5. FG5 and
This configuration is a compromise between DB-DB and Ring Bus configuration.
We extend the conventional contingency list to include the following list:
4- Functional group tripping
Stuck breaker tripping
* Only the contingencies that will take two lines completely out due to a breaker failure are considered here. For a contingency that involves one line only (and plus a bus fault), its risk is minimal and do not contribute much to calculation precision. We can let the algorithm screen these events easily. For a contingency that includes more than two functional units, the algorithm needed to be modified to go deeper. This is our future work.

84
"0- Inadvertent tripping
The IEEE RTS96 is used because it was small and was therefore convenient for debugging, and because it was the only well-known test system we have that has full substation topology and component reliability data.
4.4.1 Fault and Failure Probabilities of Power System Components
Estimating the probability of higher order contingencies is the first of two steps to find their risk. This section will focus on probability calculation. The next section will address the consequence issue. We have formula in (3.5) to calculate the probability of functional group stuck breaker contingencies and (2.12) to estimate the possibility of additional inadvertent contingencies following an primary contingency. The difficulty lies in where to find the raw statistical data we need and how to process them into the data for the formula.
The IEEE RTS-79 [49] and IEEE RTS-96 [50] provide detailed reliability model for each of the components of the 24-bus test system. Assuming the time interval between two fault events follows exponential distribution and the expectation of the time interval is Tin hours, then the probability that a fault event occurs within the next hour can be expressed as
Pr(fWf) = Pr(T < 1 Aowr) = Pr(T ^ 1 Aowr) = = l-e"'^
In this discussion, we only consider the fault probability of lines, transformers, and bus bars. For example, line 8 has outage rate per year 0.44 and transformer 9 has 0.02, then their fault probabilities are 5.0227%10"^ and 2.2831 x 10"** respectively. The fault probability of bus section is 10 to 20 times lower than a line. In [50], a 138kv bus section has 0.027 faults per year and a 230kv bus section has 0.021 faults per year. Therefore, their fault probabilities for a one-hour period are 3.08219x10"^ and 2.39726x10"^ respectively. We assume the fault probability of load, generator, and breakers are zero. Their fault probabilities can always be incorporated in the components they connect.
The IEEE RTS-79 [49] and IEEE RTS-96 [50] do not give data on the probability that a breaker fails to open after a fault. For probability of stuck break, we based our estimation on the information and method in [37]. We assume stuck-breaker is the only way a breaker fails.
We use the information in [37] to estimate the per-demand failure rate of breakers. Reference
[37] uses a detailed event tree to estimate the per-demand failure rate of two breakers

85 considering the relay. We adapted the event tree to calculate the failure probability of one breaker only as in [37]. We see the estimated per-demand breaker failure is 1 - 0.97384 =
0.02616.
3
Oi o
LU O
Q of ï
â
I
11
•75° o <3>
W8
1
II
PM=l
= 0.98876
/
P(B^)
=0.99 <
Pp c
/A,B)=0.001238
P(E/A,B,C,D)
=0.9709384
/
/
P(E c
/A,B,CP)
=0.001963
^
C)=0.0074216
=0.979384
=0.001963
=0.0074216
=0.01238
|P(B /ft)=0.01
=0.01
Figure 4.7 Event tree to calculate the per-demand failure probability of a breaker
The probability of inadvertent tripping is based on our discussion in Section 2.4. We assume only the lines that are connected to the same functional group will suffer inadvertent tripping. This assumption is valid since inadvertent tripping generally occurs in the vicinity of the initial fault. From Section 2.4, we observe that the number of JV-2 contingency is about a tenth of the number of #-7 contingencies. Based on this observation, we assume that the probability of an inadvertent tripping is 0.1. For in IEEE-RTS 96, the number of branches in each substation is about 3. Suppose the branches in a substation are L-l, L-2, and L-3, then when branch L-l trips first, the probability L-2 (or L-3) trips later is 0.05, which is the half of
0.1. Since the statistics also include stuck-breaker failure which we already accounted above as 0.02616. Then the rest will be caculated as 0.05 — 0.02616 = 0.02384.

86
4.4.2 Initial Contingency List Generation
We run the algorithms in the last chapter to find the contingencies and calculate their probabilities at the same time. The results for this analysis are summarized in Table 4.2 to
Table 4.6. The count & includes only lines, transformers, and generators. The functional groups identified by our algorithms may be easily verified from inspection of the topology data given in [50]. We removed a few redundant breakers (see the discussion part of [50]. In order to present a more practical scenario, we also did a sampling for all the generators, which resulted in the shut-down of G21, G23, G26, and G27.
Table 4.2 Summary of functional group contingencies for
IEEE RTS96 k 0 1 2
No. 50 63 4
Table 4.3 Summary of functional group contingency probabilities for IEEE RTS96
Prob/Hour 10W0' 10M0
5
No! 32 85
Table 4.4 Summary of fault/breaker failure contingencies for
IEEE RTS96 k 0 1 2 3
No. 24 90 50 4
Table 4.5 Summary of fault/breaker failure contingency probabilities for IEEE RTS96
Prob/hour 10
5
~10'
6
10-7~10"
6
No. 94 74
Table 4.6 Summary of inadvertent tripping contingency probabilities for IEEE RTS96
Prob/hour 10<~10' lO^KT*
No. 84 4
4.4.3 Estimating the Load to Be Shed
Since branch loading is a slow process and each line usually has its emergency rating in addition to its normal rating to allow overloaded for a short time period, a system operator has the time needed to perform redispatch so that the power flow of related line is adjusted to its nominal limit. Load-shedding happens only if it is impossible to bring the power flow in

87 each line back to its long-term rating using some other means. In order to simulate the action of system operator, we use the follow linear program problem to model what a system operator will do to avoid overloading.
06/gcfrve :
M'.-")
CoMJfrazMf :
' (4.32) ze{l, ze{l, ...AT},
The served load at bus i should be less than the total demand P™ at bus z;
Each generator generates between
O M F t o ^ ; ze{l, . . . ^ } , The power flow in each branch (line or transformer) is limited by its rating
5 x ^ = f ^ ' = ( ^ - ^ ) , DC power flow equations;
Branch flow equations; (Dg xX) x^-J^ =0 ,
Where
JVg is the total number of load buses;
TVg is the total number of branches; jVg is the total number of generating buses; is the load demand at bus z; or, is the price factor to shed one unit MPF load at bus z; is the total load (MPF) served at bus z; is the real power generation at bus z; is the maximum real power generation at bus z, it is the summation of rating of all generators connected to bus z;
7^ is the real power flow in branch z; is the short term rating (MK4) of branch z;

88
% is the constant factor to account for the power factor of the power flow in branch z and 12 % i> 0;
B is the T/x jV B-matrix used in DC power flow and # is the number of buses; is the M x # adjacency (or incidence) matrix
Z)g is the MxM diagonal matrix where the ^ diagonal element is the admittance of the i* branch.
0 is the # x 1 vector representing the voltage angles in radius at each bus; is the ATxl vector representing the net power injection for each bus, and its element 7? can be calculated by ^ = P - Z,.
Not all the buses are both generator bus and load bus. It is observed that some buses are load bus only, some others are generation bus only, and some others may have no load or generator connected to them. If bus ; has no generator connected to it, then we let to be zero so that inequality >7^ 2 0 will force the generation at bus / to be zero. We do the same thing for those buses without load connected to them.
In order to solve the above linear programming problem [60], we need to standardize the above inequalities and equalities so that we can use the standard LP subroutine in Matlab.
We are going to take some time to elaborate our approach since we will use this approach again for our DET generating process later in this dissertation.
We will change the object function and the constraint to the following standard format:
Objective: max x (4.33)
Constraints:
4, * =
< x ^ «6
(4.34)
(4.35)
We define
-
V "O /(jVxl)
D
2 p
V /(AW)
0 =
I
V(#xi)
(4.36)

89 nmax _
G ~ pmax r
D pmax
"^2 pmax.
V ^ V(#xi) pmax _
71
V^V(ATxl)
(4.37)
V(MxI)
^0^
0
V^/(#xl) pmm
» r
D
0 v°y
(Wxl)
. pmin _ B, max
'* /(Mxl)
6»™ = -K
V ^V(Afxl)
(4.38)
0 vOy (/fxl) a.
^0^
0
(Nxl)
= K
Po ff
V^V(Mxl) ciû — z o x
0
\^/(JVxl)
/ ( T T T T cc G
OC d ce B 0Cg
(4.39)
(4.40)
(4.41) where ^4 =
'0 0 /
\TwxAf ^AfxAf ^
-n x W
^JVxJV
^
V(M+^)x(Ar+Ar+jf+JV)
(4.42) where the submatrix v4, D and ^ inside ^ are what we have deGned at ±e beginning of this section, and 7 is the identity matrix. v4 , «6 and /6 are deGned as follows f pmin pmin
«6 = /6 =
(4.43)
pmax
V^/(M+Ar)xl n max
V* y ff m
' n
After solving the LP to obtain a feasible solution for x, we get a new system profile that has no overloading problem. The total forced load shedding can be obtained through the following formula:

90
(4.44)
We use a simple example to show our method. The following diagram shows a 2generator 3-bus system taken &om of [62]. For this system, we assume each load is of the same importance such that the cost to shed 1.0 p.u. of load is uniformly one. The fact device can adjust the flow on each line so that power flow factor for each line is 0.8, i.e. % = 0.8 for
: = 1, 2, 3 . Since we need the adjacency matrix of the graphic representation of this system, which model the topology of the power system as a directed graph, we label each line with an arrow showing the reference direction of the active power flow in the line. There is not generator at BUS-2 and there is no load at BUS-1 and BUS-3. The constraints in the LP problem formulation will force the generation at BUS-2 and the load at BUS-1 and BUS-3 to be zero.
BUS
-1
B2
B7 BUf-z
Bi -O
(gH=3Line-l: X,=0.20PU, Rate-l=0.80PU
B3
Pgmaxi-I'OPU
Line-3:
X
3
=0.25PU
Rate-3=0.30PU
DMAX2
: line-/: X
2
=U.WPU, KATEV=U.JUHU „ • "
Pgmax3=0.60PU
Figure 4.8 Example system for linear programming illustration
Objective: max -x =
(0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0)x
Constraints:
(4.45)

91
'G2
0 0 0 0 0 0 1 0 0 5.0 -5.0 0
0 0 0 0 0 0 0 1 0 2.5 0 -2.5
0 0 0 0 0 0 0 0 1 0 -4.0 4.0
1 0 0 -1 0 0 0 0 0 7.5 -5.0 -2.5
0 1 0 0 -1 0 0 0 0 -5.0 9.0 —4.0
0 0 1 0 0 -1 0 0 0 -2.5 -4.0 6.5
' £ > 1
4,3
= 0
4l
4.2
4.3
4 e
2
\ ^ y
(4.46)
0
0
0
0
0
0
-0.8x0.80
-0.8x0.30
-0.8x0.30
<
1
G1
' G 2
1
G 3
1
D2
1
D3
1
B\
<
1.0
0
0.6
0
1.0
0
0.8x0.80
0.8x0.30
0.8x0.30
1
3 2
^^3
-7t Tt
-n e
2
%" v
—n y v ^3 y
The solution for the above linear programming problem is listed in Table 4.7.
Table 4.7 Solution for the sample LP problem in Figure 4.8
4, 4:2 4
?3
42 p
*D3
4i 42 4s q % %
0.81 0 0.07 0 0.88 0 0.64 0.17 0.24 -0.065 0.063 0.0027
(4.47)
Substitute the solution of the parameters in Table 4.7, we find the max load the system can serve is 88 MW (0.88 p.u ).

92
4.4.4 Risk Computation and Results Analysis
This section gives the results of risk assessment of the IEEE RTS-96 system. We define three indices: a, /?, and y, which are deGned as follows:
Z [/-(c
; ) x P r
(c;)] a(<8
''
)=
' lPr(
C f) i which is the average impact of contingency type f,
<4
'
48> y g ( ( 5 / ) = ^ [ r ( c ; ) x p r ( c ; ) ] (4.49) which is the expected impact from all contingencies in type f, and
I[r(c;)xp,(c;)] y { a , t ) = — f y
E{l
[r(c
; ) x p r
(c;)]}
(4.50) which is percentage of the expected impact from all contingencies in type f among the total impact from all contingencies
The symbols used in the above three formula are explained as follows: m is the system load level in percentage of annual peak,
? means any of the three types of the contingencies,
; is the contingency index, is the ^ contingency of type f,
) means the MW impact of contingency when the system load level is and
Prfc,' ) means the probability of contingency C'.
Table 4.8 lists a comparison of the average impacts (in terms of load being shed) of the three categories of contingencies discussed in the last chapter. From Figure 4.9 we see that in generally a stuck break contingency has a much more severe impact than the contingency in the other two categories. A functional group tripping has the least average impact. This is expected because functional group trippings usually remove fewer components from a power system. In most cases, a stuck-breaker contingency causes at least two components to be

93 removed, and they could remove more than two components. That is why the stuck-breaker contingencies overall have a greater impact than that of the others.
Table 4.8 Expected MW load shedding by contingency types
(assuming contingency has already occur)
Precontingency. Sys. load level of daily peak
35%
40%
45%
50%
55%
60%
65%
70%
75%
80%
85%
90%
95%
100%
Functional Group tripping (MW)
1 .59
1.82
2.05
2.28
2.5
2.73
2.96
3.19
3.42
3.64
4.09
4.92
16.1
34.8
Stuck breaker tripping(MW)
13.3
15.2
17.1
19
20.9
22.8
24.7
26.6
28.5
30.5
33.1
38
56.2
56.4
Inadvertent double
Tripping(MW)
6.5
7.42
8.35
9.28
10.2
11 .1
12.1
13
15.8
20.6
25.5
33.1
56
66.2
Expected Sized of Contingencies (100M))
0.7 : ;
0.6
0.5
FG Contingencies
• SB Contingencies
• IT Contingencies
0.4
0.3
0.2
0 . 1
0
30 40 50 60 70 80 90
System Load Level In Terms of Annual Percentage (%)
100
Figure 4.9 Average MW load shedding by contingency types
110
Table 4.9 lists the aggregate expected impact (in terms of load being shed) from the three categories of contingencies discussed. From Figure 4.10 we see that functional group trippings have the largest contribution for every system loading level. This is because although stuck breaker contingencies and inadvertent trippings are usually much more severe than the functional group trippings, their probabilities are significantly lower. Therefore, the

94 majority of the load shedding is due to functional group contingencies. As the system load increases, all the contingencies are expected to cause more load shedding.
Precontingency. Sys. load level of daily peak
35
40
45
50
55
60
65
70
75
80
85
90
95
100
Table 4.9 The Expected MW load shedding by contingency types
Expected MW load shedding for all
6.68E-05
7.64E-05
8.59E-05
9.54E-05
1.05E-04
1.15E-04
1.24E-04
1.34E-04
1.46E-04
1.62E-04
1.84E-04
2.22E-04
5.08E-04
8.82E-04
Functional Group tripping (MW)
3.04E-05
3.48E-05
3.91E-05
4.35E-05
4.78E-05
5.22E-05
5.65E-05
6.09E-05
6.52E-05
6.96E-05
7.80E-05
9.40E-05
3.07E-04
6.65E-04
Stuck breaker tripping(MW)
2.57E-05
2.94E-05
3.31E-05
3.68E-05
4.04E-05
4.41E-05
4.78E-05
5.15E-05
5.51E-05
5.89E-05
6.40E-05
7.34E-05
1.09E-04
1.09E-04
Inadvertent double
Tripping(MW)
1.07E-05
1.22E-05
1.37E-05
1.52E-05
1.67E-05
1.83E-05
1.98E-05
2.13E-05
2.58E-05
3.39E-05
4.19E-05
5.43E-05
9.19E-05
1.09E-04
Expected LoadSheding (MW)
0.08
• Expected System Loadshedding
• Expected LS Due to FG Contingencies
• Expected LS Due to SB Contingencies
• Expected LS Due to IT Contingencies
30 40 50 60 70 80 90
System Load Level In Terms of Annual Percentage(%)
100 110
Figure 4.10 Expected MW load shedding by contingency types
Table 4.10 lists the MW impact contribution in terms of share in percentage for each of the three categories of contingencies discussed. From Figure 4.9 we see that functional group tripping causes lion's share for all the system load levels. An interesting observation from the figure is that when the system is approaching peak load, the stuck breaker and inadvertent

95 tripping contingencies play much lesser roles than that of the functional group contingencies, even through the absolute MW impacts for all the contingencies categories are increasing.
Table 4.10 Expected contribution in percentage of total load shedding
Load Level
(%)
35
40
45
50
75
80
85
90
55
60
65
70
95
100
Functional Group Trip m
45.54%
45.54%
45.54%
45.54%
45.54%
45.54%
45.54%
45.54%
44.61%
42.85%
42.42%
42.39%
60.52%
75.34%
Fault + Stuck Breaker Trip
(%)
38.51%
38.51%
38.51%
38.51%
38.51%
38.51%
38.51%
38.51%
37.72%
36.29%
34.80%
33.11%
21.38%
12.36%
Inadvertent T ripping
(%)
15.94%
15.94%
15.94%
15.94%
15.95%
15.94%
15.94%
15.95%
17.67%
20.86%
22.78%
24.51%
18.10%
12.30%
LoadSheding For 3 Contingency Types ( %
80
Contingencies
SB Contingencies
IT Contingencies
100
System Load Level In Terms of Annual Percentage{%)
Figure 4.11 Percentage load shedding by contingency types
110

96
Power system operators are as stressed as the systems they operate. In many parts of
North America, control center personnel are highly aware that their systems are more frequently at risk to the consequences of unexpected contingencies. As a result, there is an increasing need to provide operators with enhanced on-line information regarding system security levels, what influences these levels, and what actions should be taken or not in order to most economically achieve a improved level. In this chapter, we aim to address one aspect of this issue though anticipatory and real-time computing. The focus of this chapter is to address cascading events from an operating perspective. Major cascading events that lead to widespread blackouts summarized in Table 1.1 are usually caused a variety of reasons. The system conditions are typically characterized by heavy load, reactive power deficit, weakened transmission system, or unfavorable network flow patterns, when either an or contingency occurs. Operators in the control center usually feel uncertain when system condition makes a cascading event likely. Operators are pretty clear that a system cascading is much more likely under the condition they face, but the state-of-art technology do not provide them with a readily decision support when system begins cascading. Except for certain important contingencies, what they have is a set of general rules rather a set of contingency-specific solutions. On-line contingency-specific decisions are usually the task of system protection scheme (SPS). Usually it is designed for a limited number of important cases. Since the decision stored in SPS is predetermined, it responds much faster than operator. Yet cascading that eventually leads to large-scale system collapse often starts from small minor contingencies. If these trivial events are not handled in a short time, they tend to spread throughout the system within a few hours.
Analysis of the reports on the blackouts in Table 1.1 indicates that they may be roughly classified as either fast (less than 3 minutes) or slow, and if slow, they always involve a

97 cascading sequence. It is the slow types that we have targeted in the work reported in this dissertation. There are four typical stages of such cascading sequences.
4- Initiating contingency.
Steady-state progression (slow succession);
- System becomes stressed with heavy loading on lines, transformers, and generator;
- Successive events occur, typically the trip of other components with fairly large inter-event time intervals.
4- Transient progression (fast succession);
- System goes under-frequency and/or under-voltage;
- Large number of components begin tripping quickly.
Uncontrolled islanding and blackout.
An important attribute of the events in stage 2 is that they are almost always dependent events in that their occurrence depends on the occurrence of one or more earlier events. It is recognized that the probability of occurrence of successive events increases dramatically following the occurrence of a contingency. The time interval between an initiating event and successive events varies greatly. For example, the time between a fault and an inadvertent relay trip can be less than a second. However, if a fault followed by line clearing causes line overload and/or generator over-excitation, subsequent tripping may follow minutes or even hours later. The time interval may be long enough for an operator to initiate actions to mitigate the undesirable trend.
A primary goal of power system engineers is to reduce the frequency and mitigate the severity of blackouts. Accomplishing this requires innovations in planning, maintenance, and operations. The focus of this paper is to address cascading events from an operating perspective. Operating approaches include relieving the system via generation redispatch or load curtailment in a preventive mode, adapting the protection and control as a function of the operating conditions before occurrence of an event, or responding rapidly just after a

98 potential cascading begins to unfold. We find the third approach most attractive, as it requires no action, and therefore no cost, unless and until it is needed. In addition, it represents the last line of defense; if rapid response actions are not available or if they are not properly chosen or if they fail to occur, then the cascading and its consequences proceed without interruption or mitigation. We give this approach the name response fo WM/ô&Ang even# (RRUE), and identify it is a generalization of today's system protection scheme (SPS). The difference is in terms of flexibility and action initiation. SPS utilize pre-set fixed logic, responding to a limited set of conditions with a limited number of possible actions, while RRUE utilizes a high level of logic intelligence and, ideally, is capable of responding to all conditions with a wide range of possible actions. The action of SPS is initiated automatically by hardware, but the actions of RRUE may also be initiated by an operator. Yet, a major challenge for implementing RRUE is speed; it must recognize the possible existence of an unfolding event, analyze it, identify possible actions, select one, and communicate the actuation commands to the appropriate equipment, all within a time frame of minutes, an information-intensive decision problem requiring fast computation. We describe an approach to facilitate this in
Section m.
Section IV illustrates the approach, and Section V concludes.
We desire to enable identification and implementation of actions following the initiating contingency. The philosophy behind our approach is to prepare and revise. This philosophy manifests itself in technology that we call a dynamic event tree (DET) [63], an extension of the more familiar "event tree" to be found in the reliability literature. Event trees are horizontally built treelike structures that model initiating events as the roots. Each path from root to end nodes of an event tree represents a sequence or scenario with associated consequence. With a large amount of information uncertain, it hard to precisely predict a cascading blackout because an occurrence of such cascading is just one path among a huge amount of possible paths in an event tree that start from root to the top of the tree.
The DET idea is in part inspired from the work reported in [63] where the authors provide results of applying long-term simulation for verifying the effectiveness of different decisions under islanding conditions. It is extended from ideas [65][66] in the probabilistic

99 risk assessment (PRA) community, which largely emanates from the nuclear power industry.
It is similar to the event tree, except for two fundamental differences. First, it includes decision nodes where it is effective and possible to take actions that avoid or mitigate event consequences. Second, it is dynamic; it grows according to a set of branching ruleg, and the tree structure, branch probabilities, consequence values, and decisions are updated as necessary to reflect changes in the physical network. This means that the growth and updating processes occur continuously with as much computing power as is available. In addition, trees can be stored. Therefore, when an JV-t contingency begins to unfold, the amount of available information can be large, and the speed with which the action is taken is limited only by the efficiency of the search necessary to find the appropriate tree and the location on the tree corresponding to the particular situation at hand.
The paper [63] presents a comparison of results of applying long-term simulation program to verifying the effectiveness of different decision when system islanding happens.
We find the process can be precisely represented in an event tree structure as in Figure 5.1.
Our idea is that we could extend this process to what we called dynamic decision tree for operational purpose.
A ten-cycle three phase short-circuit at an important plant
Tie lines Tripped
Because of loss-ofsynchronism relay
Load-
Frequency control
One machine in Area
A tripped because of overspeed
Another one tripped because of undervoltage
Load
Shedding
Tie lines not ripped
No Load
Shedding
Figure 5.1 A dynamic event tree representation of SPS design
No load-
Frequency control
Figure 5.3 illustrates the idea, where the system avoids a collapse after two timely actions are taken. The sequence of events comprising the Figure 5.3 simulation is captured using the

100 simple DET of Figure 5.3. The DET edges represent events, including initiating and successive events of cascading sequences, power system behaviors, and actions necessary to mitigate undesirable consequences and avoid blackouts. For example, the initiating event in
Figure 5.3 is a fault with stuck breaker resulting in loss of three components. This event is represented in Figure 5.3 by Branch CI. Branch B2 represents a fast voltage collapse, and
Branch B3 represents the actions of under load tap changing transformers in the network. B1 is a null event, which means no action is taken. Branch A1 is an action taken to arrest the fast voltage collapse, and Branch A2 is an action taken to block the transformer tap changes and avoid the slow voltage collapse.
Bus voltage
Action-l: insert shunt cap
1.0
10 sec n a n
Cjm
Action-2: block LTCs
5 m in
Conthgency-1:
Fault +N-3 outage from stuck breaker
Behavtor-2:
Fast voltage collapse due to lack of reactive power
Behavtor-3:
Slow voltage collapse due to
LTC action
Behavior-Is
System is normal. Everything is within limit.
Figure 5.2 Illustration of halting voltage collapse by dynamic event tree
B1
Figure 5.3 A dynamic event tree illustration
These events do not necessarily happen at one time instant. Usually they are associated with a continuous time interval. For example, the voltage collapse event B2 in Figure 5.3 is actually a continuous changing process rather than an abrupt occurrence; the contingency event CI in Figure 5.3 is not the fault/stuck tripping only, rather, it is the tripping plus the

101 behavior of the system that defines the event CI. Thus, each branch in the DET corresponds to one or a sequence of events.
The nodes in an event tree correspond to system states represented by the large black dot
37-7 in Figure 5.3. As an event tree is a discrete structure whereas power system condition must be characterized by both discrete and continuous variables, we must discretize system states so that the number of nodes in an event tree is limited. We therefore introduce the concept aef q/egwfva/gMf gfofes (SES). An SES is a set of system states that respond the same
(equivalent) way to a specified event Therefore, an SES may only be defined in relation to an event. So each node in DET is not a single power system state; rather it is an SES to the branches (events) that follow.
Generating a DET occurs via the procedure illustrated in Figure 5.4. We provide a brief description of each of the main elements illustrated in this figure.
> Lightning
> Precipitation
> Wind
> Temperature
> Near Term Day
Ahead Load
Forecast
> System component parameters
> System topology
> Protection logic & settings
> Lines
>• Transformers
> Loads
> Shunts
> Generators y Breaker y Switches
)- System state (power flow solution, breaker switch status data, and network topology)
> Initiating event identifier and probability estimator
> System state discretizer
> Successive event identified
> Action identifier
> Simulator
Figure 5.4 Dynamic event tree generation procedure
Figure 5.5 illustrates an ideal dynamic event tree with each contingency event followed by a single action branch to correct the problem caused by the contingency. The algorithm follows

102 illustrated the procedure to produce a DET in Figure 5.5 for each discretized system states for a 24-hour period. Figure 5.5 for illustration is for illustration purpose only, in practice, the subtree starting from any primary contingency may be as irregular as the one illustrated in
Figure 5.2, or may have no further development at all. The algorithm for irregular DETs will be covered in detail Subsection 5.4.2.
C : confinggMcy even/
A : action event
AM#
Superscript : the depth index in event tree
.Fu&ycnpf : fAe w%6A imier in gvenf free
Figure 5.5 A simplified ideal dynamic event tree
1)
2 ) run Mon-coMfzMggMcy
Aowry j?gno<f. of fAg jpowgr yôr «gif cby 2^
(/wcrgfize fAg 6gAov;or of fAg ^owgr fygfg/M of 2^-Aowr /wriod mfo a /imffgt/
Mw/M^gr of roof sfof&y jR„) , givg» fAg z^rmafzoM ;«pwf fo gngiMg in fzgwrg J. 4.
Zoae/ Zoot/
24 j;
24 /%%//s
Zoqp 7. For gacA roof Modie <—
; = 1, 2, M, &) m;f;a/izg DjETl wzfA roof «oak 5""

103
7)
6f)
P)
70)
77^
6)
72)
7j)
74)
7 j) ggngrofg confirnggncy Zwf fCl, ={C,, Q, C,j _/br 7^ Ay fcoMMfng fAg ^?rg(7;cf sysfem fqpo/ogy.
" f C7,. <—/wMcfzona/ growp fnp confiMggMczgs
" fCZ, <— fCL, 4-sf«ct 6rga&gr fnp coMfi»ggMcigs
" f CL, <- fCL, + znaffwgrfgMf D-g? ConfôiggMczgs
" f CL. <- fCL, + ofAgr jysfgm jpgci^c coMfz/zggMczes
7oqp2yôr gacA comfzMggmczgs C, in f CL, n/M /ong-fg/TM afynoTMic simw/afzoM_/br Cy Jbr 7]^ sgconak sforg fAg sysfgm rgsponak m 7(P3, scan TtfS", fo ^;agMOjg aW zJleMf^ any /;roA/gm cmwgff Ay C consfrwcf noc/g S"' wzfA sysfgm sfafws Agmg m proA/gm cawsge/
AyCy consfrwcf ArancA Cj os a 7mt Agfwggn
(Mc/Wg fAg gvewf Cy
<zf%7 Sj wAzcA fAg rgspomsg qf jysfg/M Agfwgg» aw/ seorcA fAg ava;/oA7g acfzom sgf fo ;<^enfz^ a ^gas;A/g (zt/ga/Ty qpfzma/ so/wfzon) decision v4, ^)r fAg /?roAZgm cawsgd 6y Cy r»M /oMg-fg/TM (Tynamzc szmw/ofzoM fo vgri^/ fAg g^gcfrvgngss qf
/or 7L% ^ecoMùb consfn/cf Moefg wzfA sysfg/n sfafws as fAg rgsw/f cazzsgcf Ay
7(^) comsfrwcf ArancA v4y as a /mt Agfwee/z 6"j o»(7 S'y .wAzcA z/zc/w^es fAg gvg/if y4, and fAg respo/zsg qf sysfg/M Agfwgg»
7 7)
7&)
7oqp2 gnak savg DfTj
7P) /oqp7 g»af
20) g«(7 qf/4 /gorzfAm aw/ S'y
The final DET for a 24-hour time frame from the algorithm will be like Figure 5.6. the
{72,, Tf],--, 7(„} are discretized SES (define in Section 5.1) of system states. From each state, the algorithm generates a DET for that operating condition. For illustration purpose, the DET for each 7f, looks similar in Figure 5.6, but they are actually quite different from each other.

104
For example, the primary contingency list is based on the predicted operating condition and predicted topology information at that time. They change with time. From the graph in step 2) of the algorithm, we may see that each Tf, actually covers a time interval within the 24-hour period. The time intervals are not necessary equal to each other. In Subsection 5.2.3, we will discuss this and provide one criteria and the algorithm to divide the trajectory of system operating condition into discrete states. It is import for the reader to know that this does not mean that the maximum time each individual DET covers is constraint by this time interval.
Each 7%, just provides a starting point for DET. How much time the DET should extend is solely depend on the need and computation capacity. It is quite possible that a single DET extends more than 2 hours. This time frame is in accordance with our observation of many cascading events. If we treat as nodes in an event tree and branch (transition path) between these nodes as null event, then the whole structure in Figure 5.6 becomes a grand DET that is applicable to the whole 24-hour time framework.
[S2
84]
Figure 5.6 A grand DET for one day time frame
5.2.1 Day-Ahead Forecasting System
The day-ahead forecasting system performs two functions: a) forecast next day component on/off status according to generation and maintenance schedule; b) forecast next day load/generation profile. These forecasts are made assuming that there are no unintended events. The function of this element is to predict the future status and levels of key variables affecting the physical performance of the power system. These variables may be discrete, as

105 in the case of circuit or generator up or down status, or they may be continuous, as in the case of load and generation level.
One of the inputs to this functionality includes day-ahead weather forecast. Weather forecast information is also used to update contingency probability within the DET engine.
For example, the tripping probability of a line may increase due to die expected presence of lightning or hot weather. Reference [67] provides an interesting discussion on calculating the probability of transmission line sagging.
5.2.2 Initiating Contingency Selection
The breadth and depth of a DET is guided via intelligent initiating contingency selection and tree growth rules. A set of initiating contingencies is selected based on the approach outlined in Chapter 3 resulting in a contingency list comprised of the N-l and N-k initiating contingencies having probabilities greater than a user-specified threshold. It is intended that the probability level is chosen so that the initiating contingency list is much larger than contingency lists used for security assessment in most control centers today. We have designed an algorithm to process switch-breaker data (as used in most EMS topology processing functions) to identify contingencies, and their probabilities as a Amotion of substation topology, protection failures, and common mode events in Chapter 3. These contingencies constitute the first tier of branches for the DET.
Once a set of contingencies is selected, it is necessary to arrange their processing order according to one of three tree-growth rules. The probability-based rule orders the contingencies in decreasing probability. The severity-based rule orders the contingencies in decreasing severity. The risk-based rule orders the contingencies in decreasing risk, where risk is the product of event probability and event severity, a rule that attempts to find a balance between the probability- and severity-based rules. The risk-based rule is most attractive; however, it (and the severity-based rule) suffers from the fact that severity is unknown until the contingency is analyzed. Thus, preliminary severity estimation is needed for each contingency. The number of components outaged in the initiating contingency (& in
"M-&") is such a measure. Although it is rough, it enjoys the benefit of being available with no additional simulation.

106
Successive event modeling is challenging. At one extreme, we could implement the initiating contingency procedure for each node in the DET, resulting in an event list for each of the nodes. Such an approach would require estimation of successive event probabilities as the computation proceeds. We have implemented the simplest form of this approach where it is assumed that, following (and excluding) the initiating event, all equipment operates as designed with probability 1.0, and events associated with unexpected operation (e.g., breaker inadvertent operation) have probability 0. Although this approach eliminates modeling of protection failures as successive events, it does not eliminate modeling of protection failures since they may be included in the initiating event
5.2.3 Discretize Continuous State
A change in network configuration due to, for example, loss of a component, results in a clearly defined new state and is therefore a precisely identified event and corresponding DET branch. Small changes in operating conditions normally need no special treatment, yet accumulation of small changes can build up until it is necessary to treat the change as an event or a state transition. In establishing a basis for doing this, we observe that an action that mitigates a cascading sequence initiated from one operating condition may also mitigate that cascading sequence initiated from a similar operating condition. Thus, we desire to lump all such operating conditions into a discrete state. The easiest way to discretize operating condition is to divide, for example, the next 24 hour period into equal intervals and assume that each operating condition within each time interval is an SES. Figure 5.7 shows the hourly system load change in one typical winter weekday [49]. As we see from the figure, the load increase between 5:00am to 6:00am is almost 15 percent. Any contingency analysis results we obtain for the power system condition at the beginning of the hour (5:00am) would not be applicable at the end of that hour (6:00am). The solution to this problem is to use isovariance time intervals, where the system experiences the same amount of total load variance for each time interval. The right of Figure 5.7 illustrates the results of discretizing operating condition by iso-variance for a typical weekday loading cycle on the left. The right of Figure
5.8 shows the results of discretizing operating condition by iso-variance for a typical weekend loading cycle on the left.

107
This is just an example to discretize power system operating conditions efficiently. It may be combined with other considerations. For example, we may need to assign more root states for afternoon hours to reflect the fact that a power system is at its peak load and cascading are more likely to happen for this time.
System Load In Percent Of Daily Peak System Load In Percent Of Daily Peak
Si
20 21 22 23 24 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
Hours In A Day(Winter Weekday) Hours In A Day(Winter Weekday)
Figure 5.7 Discretize operating condition by 24 equal time intervals and by equal load variance
(weekday)
System Load In Percent Of Daily System Load In Percent Of Daily Peak
110 y f • ' ' ' • "I . :
0 1 2 3 4 5 6 7 8 8 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
Hours In A DavfWinter Weekend) Hours In A Day (Winter Weekend)
Figure 5.8 Discretize operating condition by 24 equal time intervals and by equal load variance
(weekend day)
5.2.4 Simulator
A time domain simulator is the preferred analysis tool for developing DETs. However, it must be specialized to perform extended-term (several hours) of simulation quickly. This means it must model both fast and slow dynamics and be capable of lengthening time steps when fast dynamics are inactive. In addition, it must have the necessary intelligence to recognize when failure conditions are encountered, retrieve earlier conditions, and determine appropriate actions; it must also have modeling capability for a wide range of protection devices. Finally, in order to combine it with contingency identification and apply it online, it

108 should be able to integrate with system real time topology information seamlessly. A prototype simulator was developed for this work with these characteristics, with appropriate models of generator excitation systems, speed-governing systems, and automatic generation control. The simulator will be discussed in Chapter 6.
5.2.5 Action Selector
The decision set includes any operational procedures that are available, e.g., generator redispatch, load shedding, shunt capacitor insertion, generation rejection, HVDC ramping, etc. Of these, unit redispatch and/or load shedding are almost universally effective (although not always optimally so) in mitigating deteriorating conditions, and so we have elected to design into our simulator an algorithm for identifying these type of actions in Chapter 6; we have not yet designed algorithms for identifying other types of actions. We use the linear programming formulation in Section 4.4 to find the action necessary to back off any line loading exceeding a specified threshold. The objective is to maximize load with a constraint that prevents loading from exceeding actual demand, so that the actions identified utilize unit redispatch first and then load interruption to accomplish what unit redispatch cannot.
A DET is a rich container of information about the power system when the system resides in a state corresponding to the DET root node. We store DETs for possible later use. The
DET storage bin contains many trees. Each DET is indexed according to conditions that indicate whether the DET is applicable to a given state. These "DET indexing conditions" are loading trajectory, network configuration, and weather conditions and forecast. It is possible to find a tree having indexing conditions that are very similar to the existing power system conditions but not exactly the same. In this case, one may quickly update the tree using approximate methods rather than generate a new one. Such DET updating occurs to the probability values, the severities, or the selected actions.
The core of DET generating process is a time domain simulator. Our analysis requires it to be capable of doing:

109
* TfopW /ong-ferm sf7Mw/af%oM: It must be capable of performing rapid long-term time domain simulation;
* Tqpo/ogy Processor o JExfracf Fb/foge 6ws o fxfrocf Fi/nef (orna/ Growp
* SAorf ferm jfysfem CoM(/;fioM Forecosfor
We use the term 'system condition fbrcastor'(SCF) rather than 'system load fbrecastor'(SLF) because we see SLF as part of SCF. In addition to load information, any other scheduled operation regarding a power system is also included in SCF.
* .Dynamic fine rafmg
* ProfecfioM mode/s: It must be capable of modeling influences that contribute to cascading events; minimally, this would include an extensive suite of protection system models.
* Dzscfgfize Qperofmg Co/K&fzon
We are not aware of any commercial tool today that has these capabilities, although the
Eurostag program, developed by Electricite de France (EDF), comes closest in that it seems to satisfy the above with its adaptive step size and its extensive modeling ability.
Using such a tool, one can design actions to be taken to appropriately detect, analyze, and identify mitigating actions for a possible cascading event in Figure 4.1. The implementation of DET is a matter of automating this process.
That means we need to do more than design a simulator. Our concept of DET is not simply a simulator. It is a contingency generator and decision maker (in the sense that it automatically chooses actions and simulation its effectiveness) as well. It is apparent that, once constructed, the DET would then contain the intelligence to mitigate the particular contingency referred to in Figure 4.1 as event 1.
We expect to have prototype of DET generation implemented on a small-scale test system.
5.4.1 Dynamics Simulation
According to [67], long-term dynamic simulation should model the following protection and control devices:

110
Generator and excitation system protection and controls
4- Electrical network protection and controls
4- Prime mover/energy supply system protection and control
We currently are designing programs to model the first two parts. In addition, we also plan to model the slow dynamics of load variation.
5.4.2 Template DET an H Àmnmhous DET
The idea of recursive programming is that a function calls itself repeatedly until some condition is reached, e.g., event probability becomes small, or stack memory is used up. To the program, each node in DET is just a network status like other nodes (including the initial node), with a known past and uncertain future. If we consider DET as a directed graph, i.e., a node can reach another node only through a one-way path and only from left to right, then the known past is simply the path from root node to current node and the uncertain future is the subtree the current node spawns. Every node is equal in the sense that the program code designed to generate the next node is the same for each node. The procedure may be like this: ybmcfzo/z GenerafeDTiT (SfqpAfgcAarzzsTM, CwrrerzfAafe, 7%for%) afep 7. if AopAfec/zanzsm i? reac/ze<# refwm, sfgp 2. c/zec& cwrre/zf /power rysfe/M jfafe aW z6 rece/zf /zzsfo/y, f&erz generate a /«f of eveMfsfco/zfzMggMcy or acfzorz); sfep j \^r eac/z evenf zm f/ze W, rw» GefzerafeDjET.
StopMechanism just provides a stopping mechanism for the generation process. Indices such as MaxDepth, MaxConsequence, or MinProbability may be used.
Note function GenerateDET calls itself in step 3.
5.4.3 Use of Computing Resources
DET computing is done continuously. However, a key problem is to identify what DET computing to do at each moment. We desire to optimize the "readiness" for a given time frame. Readiness can be thought of as the ratio of two quantities that reflect: the cumulative probability of all situations for which we are prepared and know how to respond, and the cumulative probability of all possible situations that can occur, which is 1. State variables for this problem are existing trees and corresponding DET indexing conditions. Decision variables are task allocation for each CPU, where it is possible for CPUs to either contribute

I l l towards growing a new tree or contribute towards updating an existing tree. Constraints on this problem are computing resources and available time.
The algorithm to generate a DET for a large-scale power system is computationally intensive. Suppose the maximum number of nodes that result from any initiating contingency is bounded by m and the maximum time needed to generate the sub-tree is 7^,, which is reasonable given that we can control the depth and width of the sub-tree from any initiating contingency. If the number of initiating contingencies to be simulated is C(7V), then the total time spent on generating a DET is bounded by C(7V)% 7^,. Better algorithms, parallel processing, or faster machines and other emerging new technologies can be employed to minimize 7L For example, the analog simulator [78][79] provides a promising simulation tool reported to be 10* times faster than the conventional digital computer.
The state of readiness for existing and near future conditions is maximized by the availability of a DET corresponding to those conditions. Once a contingency occurs, the operator is immediately shown the corresponding tree of events and recommended actions, which includes the time intervals between different events and between events and actions, giving the operator the benefit of viewing the future for different alternatives that are available. The operator may then actuate or prepare to actuate one or more actions, depending on how far down the tree the decision node is from the node corresponding to the current conditions.
The DET also serves as an efficient preparatory tool operators may use during their shift to study the variety of contingency scenarios and recommended actions for those scenarios.
Studying the appropriate DET provides insight into how to respond to the various contingencies that might happen under conditions that exist or that are expected in the near future. It could be expected the operators who have spent a significant time studying DETs on their system for various conditions would develop a unique familiarity with how their system responds under severe contingencies and with the typical actions necessary to avoid or mitigate resulting consequences.

112
We propose a generalization of the SPS intended for providing rapid response to unfolding events (RRUE), especially focusing on dependent events that would otherwise result in severe consequences. The basic philosophy underlying the approach, to continuously prepare, revise, and store assessment results and decision-making, provides that responsetime following a first event is mainly limited by search-time. A key technology facilitating the approach is the dynamic-decision-event tree (DET), which has application in analyzing the reliability and risk of nuclear power plant. DET provides the ability to adapt decision logic to conditions as they evolve, in contrast to pre-fixed, static logic usually implemented in today's SPS.
Simulation model complexity
'-i -f
1
. -
Event with probability order 1
(e.g. Functional Group
Tripping)
Events with probability order 2
(e.g. stuck breaker, protection malfunction after disturbance )
Events with probability order higher than 2
» Initiating event probability order
..-W. K-'i-i'v
System Islanding
Decision sets priority
Figure 5 .9 Complexity of DET in three dimensions
(terms of Initial event set, decision set, and simulation algorithm)
Whether the DET approach is feasible or not to real-time operational decision depends on the state of the art computing technology and resources, the algorithm carefully. DET is an open structure. All types of power system contingencies and decisions can be incorporated.

113
However the set of all contingencies and decision is either unaccountably unlimited while our computing and storage are always limited. The process of generating DET has three dimensions of choices:
1) Dimension One: Initiating contingency set
2) Dimension Two: Simulation algorithm
3) Dimension Three: Decision set as shown in Figure 5.9.
5.6.1 DET and SPS
To some extend, DET may be regarded as an agent that designs system protection scheme
(SPS) online. In idea case, the computer replaces the role of human to make SPS online.
However, except this time frame difference, there are several other important differences between DET and SPS.
The actions of SPS are predetermined once it is in operation. It cannot change the scheme by itself without the interference of operator. The actions DET takes are more flexible; it may provide different choices to the operator according to different condition.
SPS are often designed to act after a rare contingency occurs, however DET considers a full list jV-7 contingencies as well as some more likely high-order contingencies.
SPS, by definition [2], only takes corrective action, that is, SPS only takes action after a contingency or abnormal condition occurs. DET provides preventive action as well as corrective actions.
5.6.2 DET and Contingencies List Method
Although contingency list method seems an efficient way to use computation resources, it does not mean that it can effectively prevent cascading events. Many systems require that a single contingency should not be able to render the system in a state of stability, load shedding or undervoltage. To verify if this operational rule is satisfied, it is not necessary to do simulation for all the contingencies online. With contingency list method, operator can do simulation only for those contingencies that ranks high in the list. Once a violation is found, it is necessary to take corrective action to bring the system to a stronger state.
A close look at the large events [4] may find that none of them is initiated by the contingency that rank highest and they are initiated either by multiply contingencies or by

114 fault on a line that is not most important. Many secondary contingencies are also involved.
This observation suggests that we need to do more than only study the most important contingencies. Two things that essential to DET but not to contingencies list method are
4- DET simulates all JV-7 contingencies plus a limited number of high-order contingencies.
4- DET can do time domain simulation to study the trend of a power system online so that many possible secondary contingencies can be identified.

115
In this chapter, we are going to test the DET concept with a small but complete test system. As we point out in the Section 5.6 of the last chapter, DET is very flexible and configurable in terms of computational complexity. In this chapter, we choose one of the most complex way to track the power system status - long-term time domain simulation.
We use the slow dynamic simulation program we developed for this specific purpose. It starts from the basic topology information in EMS database and formulate the DAE equation automatically. The initiating contingency sets include the same three categories we mentioned in Section 0 of Chapter 3 and Section 5.6 of Chapter 5. The available decision set is all feasible combinations of feasible generation and load. The objective is to maximize the total amount of load being served. We use the same approach we illustrated in Section 4.4 of
Chapter 4.
This test system is a small non-trivial system with 6 generators, 21 buses, 21 lines, 9 transformers (including generator step-up transformers), and 3 tie lines. We developed this test system 6om the test system of [69]. We doubled the size of the system joining two identical copies of the test system with three tie lines (L301, L302, and L401) and three transformers (T301, T302, and T401). We also designed substation for each bus. For each generation plant, we use one and a half breaker substation configuration; for load bus, we use ring bus configuration. We like to point out that our simulation program does not include the traditional concept of "BUS" rather, it read in breaker bus-section (sometimes it is called bus bar) diagram of the system. The program processes the topology of system diagram and finds the buses via a search. In this section, we test DET on a small test system, since there are not many published test systems that include subsystem one-line breaker

116 diagram together with system dynamic parameters. The only test system identified is IEEE
RTS 96 system among the published system with one line breaker diagram, but we do not have the detailed dynamic parameters of the generators and control device for this system.
We use the test system in [62] as the basis for our DET test system. We designed the substations for this system and doubled its size by adding an identical system below the original system as shown in the APPENDIX B of this work. We denote the two subsystems as upper area and lower area. We also add four tie lines (and four transformers) to connect the upper and lower area. To create the tie line flow, we scale down all the loads in upper area by a factor of 0.8 and scale up all the loads in lower area by a factor of 1.2 so that there is a 20% percent of total load (630MW) flow on the tie lines. The generation configuration remains unchanged. In summary, there are 22 buses, 6 generators, 6 load, 40 lines (including
4 tie lines), 6 step-up transformers, 4 tie line transformers, and 128 breakers.
6.1.1 List of Test System Components and Parameters
APPENDIX B gives the one-line diagram of the test system. All the bus sections and breakers have a unique number identification. The DET simulation engine uses this information to process the topology of the test system. APPENDIX C gives the parameters of generators, lines, breakers, transformers, and loads.
6.1.2 Control Devices
A. Exciter Model
We use a simple PI controller for generator terminal-voltage control. The block diagram of the governor is shown below in Figure 6 .1.
©
+
Figure 6.1 Governor block diagram of test system
E f

117
B. Governor Model
The governors are all modeled as a speed integrator with droop ratio if as in Figure 6.2.
7c* is the time constant for hydro-mechanically server, which is modeled as a inertia link.
The output of the governor is 7, which is the mechanical power input to electric machine. is the output of AGC, which is illustrated in Figure 6.3. As shown in Figure 6.3, it is actually summation of the gate reference and the AGC adjustment signal. Note we assume every generator participates in the global frequency adjustment.
®r
Figure 6.2 Exciter block diagram of test system
C. AGC Model
Figure 6.3 illustrates the AGC model we are using. The aim of the AGC is to regulate system frequency to . Any deviation from this value will be sensed by the AGC. The inverse of the time constant in each of the integrators in Figure 6.3 is proportional to the size of the unit, for which the output signal intended. This way a larger generator contributes more to frequency regulating and a smaller generator less.
7&i sT sT,
Figure 6.3 AGC block diagram of test system

118
D. Over-excitation Limiter Model
We use the summed-type over-excitation limiter (OEL) model [70]. The regulating part of the OEL is a pure integrator. It simulates the heat build-up in the exciter. A wind-up limiter [67] is added to the integrator to limit the output of OEL to exciter. The direct output of OEL is not limited because it is a reflection of winding temperature rather than a concrete element that has a physical limit. y,
+
1
Soumit
/ / ^OEL ( D
+
Ef h
OEÉ owa
'
IimU
Figure 6.4 Over-exciter limiter block diagram of test sytstem
The set of differential equations is as follows
%
= 0 — 1
00) a
6E'
= [£DF-£,+(Z,-Z;)/,]/r;
0 gf
-[i'-i'.l
/rc.
° X x
( a , r
- a , ) + R ( L ^ - S J T , ) ] / :
6AE f g
, =[-AB
/+
£,
+
^(^-l^)/,]/r,
(6.4)
(6.5)
(6.6)
(6.7)
(6.1)
(6.2)
(6.3)

119
In the above equations, these equations are for all the generations including the exciter, governor and AGC models. The notation for exciter, governor, and AGC are the same as we showed in Figure 6 .1-3. For generators, the meanings of the notation are the same as what is in [69]. The limiter for each variable is implemented as logic in program and is not shown in the above equations. The program checks all the variable limits for each integration step and correct them if necessary. We use the two-axial model [69] for generator dynamics.
The set of algebraic equations are as follows, where ; means the generator and y means the/* generator bus.
9
—
c r'
+
= 0 for each generator; v
:
= o sin#%
-sin#' v
F
/y cos#'
(6.8)
(6.9) for each generator bus; f l t
\ sin#% cos#' v^y
= 0
(6.10) for each generator bus;
X
K
V
;
K for the whole linear impedance network with « voltage bus (
(6.11) is the system admittance matrix );
( c
^'1
= 0
Uy
(6.12) for each load bus with constant P and Q. The loads in our test system are modeled as constant active and reactive power injection.
Equations (6.8) to (6.10) are for each individual generator. Equations (6.11) and (6.12) are for the whole network and each voltage bus respectively.

120
The long-term dynamic simulation program has been of great interest nowadays. This is partly due to the increase in speed of computer, which has made the long-term simulation of large-scale system possible within the acceptable time scale. Another reason is that the response of a power system to disturbances is not only decided by fast dynamics of its machines, it is also decided by the action of slow processes, such as tap changers and load dynamics. These slow dynamics may not cause an immediate problem after a disturbance; rather they often cause voltage problems and/or thermal loading problems after an extended period. The last, but not the least reason is the availability of sophisticated integration algorithms which made large simulation time steps possible. Some commercial programs
such as EURO STAG, GE Exstab, and TSAT have successfully implemented the so-call "Astable" implicit integration program [71].
There are two ways to categorize integration algorithms: single-step / multi-step and explicit/implicit. The single step method does not use the solution information in the previous steps for the solution of the next step, although it may divide the current single step into several small intervals to improve the solution precision, as what is done in Runge-
Kutta. Multi-step methods use the prior solution information, which includes the derivative of the state variables as well as the state variables themselves. The advantage of multi-step methods lie in the fact that they are faster compared with single step methods to get the same solution precision. However, some report [72] indicates that the performance of
Runge-Kutta methods is more attractive than that of others in tough conditions like discontinuity. For explicit methods, the next step calculation uses only the solution information known; implicit methods, on the contrary, use the unknown solution information of next-step(s). Iterative methods, such as Newton method in power flow solutions is needed to solve the implicit non-linear equation for implicit method. The most attractive feature of implicit methods lies in the fact they allow very large time steps (as large as 20 seconds in EXSTAB [74] and 10 seconds in EUROSTAG [71]) without losing numerical stability.
GE's EXSTAB is based on the f&efa mef&ocf, which is similar to trapezoidal rule but gives better performance [74]. EUROSTAG is based on mixed ADAMS-BDF method [71].

121
Both the theta method and ADAMS-BDF method are which means that if the system poles (eigenvalue of the linearized dynamic system) are all located on the left half the complex plane, these method are always numerically stable regardless the size of time step.
For the testing program, we use "Theta method" because it does not have the infamous
AaMzfy problem [71], which means that an algorithm falsely reports stability when the physical system is actually unstable. A general power system dynamic algebraic equation (DAE) groups for equations in (6.1) through (6.12) can be summarized as
( 6 1 3 )
0 = g ( j c , y ) where x is a vector of state variables in (6.1)~(6.7)
(6.13) is the group of equations in (6.1)^(6.7) y is a vector of the variables in (6.8)-(6.12) excluding those in x
(6.14) is the group of equations in (6.8)^(6.12)
The theta method for the DAE in (6.13) and (6.14) can be expressed as
]
Discretize (6.13) and (6.14) using Theta-method, we find
(6.14)
( 6 1 5 )
(6.16) g(z»+i,X,+,) = 0 (6.17)
Note in (6.16) and (6.17), only %„+/ and are unknown variables and the rest are all known. The DAE equations now are transformed into a set of purely algebraic equations, which can be approach by the established Newton-Raphson method efficiently. We choose 0
= 4.7 for our program, as suggested in [74].
We are not going to discuss our simulation algorithm further. Readers interested in this topic may refer [71]-[75] for further information.

122
We test our DET dynamic simulation engine on the Ontario Hydro 4 bus test system (see
Appendix A for details of the system). Since our program builds network model directly from EMS's one-line substation in addition to an initial converged power flow case, we added 18 breakers to the test system so that all the lines, generators, load and shunt can be isolated by opening the associated breakers. Other parameters of the system stay unchanged.
Before fault, the statuses of generators are listed in Table 6.1. Since we model all the loads in the system as constant impedance, these initial generator parameters are sufficient to decide all other variables like bus voltages and line flows. The exciter model we use is a standard ETMSP Type 30. The scenario we simulated is a 3-phase ground fault at bus 5.
The fault was cleared by itself after 0.01 second without any breaker operation. We use the
ETMSP application as a benchmark to our program.
No
1
2
3
4
Table 6.1 Initial status of generator for Ontario test system
V-abs
1.03
1.01
1.03
1.01
V-angle
2.928
-7.906
0,6634
-8.78658
P
790
790
690
740
Q
77.57608
188.01250
69.85064
85.26508 ref
'FD
E 2
= 200 7^ =0.01 T,=0.01 7^, =10 7^=0.1
Figure 6.5 ETMSP type 30 exciter for Ontario hydro 4-generator system
The simulation results from the ETMSP application and our DET dynamic simulation engine are presented in Figure 6.5 and Figure 6.7 respectively. The two figures are almost

123 identical. The minimal différences are probably introduced by different algorithm the two programs use. The ETMSP application uses fixed step Runge-Kutta algorithm [76] for integral while the DET engine uses step-variable implicit integration algorithm [72] [74].
G«mRWOu*ut ETMSPSMUL*nON RESULTS
8.1
7.9
77
7:5
7.1
6.9
6.7
65
O
1 2 3
5
6 7 8
Figure 6.6 Response of generator after a temporary fault at bus section 5 (ETMSP)
©est Real Oulpu#
<FU.)
E3 ,
DET SIMULATION ENGINE RESULTS
7,9
7.7
7.5
7.3
7.1
R.9
#4
# 2 3
4
5
T*ne (second)
E 7
8 9
1®
Figure 6.7 Response of generator after a temporary fault at bus section 5 (DET engine)

124
The test simulation uses the current system topology to generate an extended contingency list as the first tier of event nodes. An iterative programming technique and an
LP optimizer are then employed to build a DET for each contingency as illustrated in Figure
6.8. The branches Bl, B3, and B5 represent the initial contingencies, the system reconfiguration, and the emergency loading respectively, The branches B2 and B4 represent the "do-nothing" decisions. The nodes (^,'s) in Figure 6.8 represent the status/trajectory of the system after/before the actions (B/s) are applied to the system.
Initial contingency
(N-l or N-k)
First corrective action
(Redisptach)
Secondary corrective action (Load-shedding)
N/A System status Normal/Abnormal
Figure 6.8 Dynamic event tree template for DET test system
6.5.1 Test Scenario
We studied the possible cascading for a one-hour time interval during which the load ramped 20% from 900 seconds to 2700 seconds for a scenario where the system is in a weakened condition due to the outage of a tie line. Line loadings are monitored, and the most effective redispatch & load curtailment actions are identified for overloaded lines.

125
System Load (%)
125%
120%
115%
110%
105%
•System Load Curve
100% '30 minutes
0%
0 500 1000 1500 2000 time (s)
2500 3000 3500
Figure 6.9 System load ramp curve of DET test scenario
4000
6.5.2 Contingency Event Branch
We generated a comprehensive list of initiating contingencies for the selected scenario, as summarized in Table 6.2. We are not going to elaborate how and why we generated these contingencies since they are accounted for in Chapter 2 and Chapter 3. The count in "JVincludes components that are open-ended as well as those that are completely disconnected from the system. There are 12 #-0 contingencies that do not result in losing any components; these are bus faults at substations with breaker-and-a-half protection design. Since we are going to do dynamic simulation (both long-term and transient in one application), we assume faults are cleared without any delay. These do not compromise our analysis since a close examination of all the NERC's record [4] of major power system disturbances find an initiating fault never causes the immediate collapse of a system; rather it is usually the slow stead state progress of system that causes serious problem.
Table 6.2 Identified contingency summary for test system
N-2 N-3 N-4 N-5 Contingency Category
Functional Group Removal
(line fault, bus fault, etc.) fault plus stuck breaker
Inadvertent Tripping
(Simultaneous loss of two branches )
Total
N-0
12
0
0
12
N-l
48
49
0
97
6
63
114
183
0
3
89
92
0
1
15
16
0
0
2
2
N-6 total
0 66
0
2
2
116
222
404

126
6.5 J Decision Event Branch Set and Decision Identification
The decision set is the combination of all the redispatches of all the available generators and load curtailment, if it is necessary. We assume any of the available generators can generate between zero MW to its maximum output.
We use linear programming optimization to find the primary redispatch to back off any line loading that exceeds a specified threshold. The linear programming problem is defined the same way we illustrate in Section 4.4.3 of Chapter 4. It is solved only whenever it is necessary, i.e., the flow on a line exceeds a defined percent its emergency loading. After we find the primary redispatch, we set the governor setting of each generator according to the redispatch and simulate the response of system to check if the redispatch is effective. Since the system total load increases between 900s and 2700s, decisions that are effective for now may fail after loading increases to certain level. In that case, we apply the secondary decision straightforward: direct loading shedding, i.e. shed any increased load(s) that cause new problem.
The result of the DET engine computations for this scenario is a large repository of information that includes contingency specification, the response curves of all key variables for that contingency, and necessary actions. Of the 404 contingencies we analyzed, 10 resulted in fast (within 1 minute) instability and 394 of them resulted in stable, but unacceptable performance. Our implementation of the DET engine does not generate a corrective action for cases resulting in instability within 1 minute since this is not enough time to implement operator-initiated actions. Of the other 394 contingencies, all of them resulted in overloading problems that were corrected by proper generator and load reconfiguration as identified by our optimization approach.
Figure 6.10 illustrates a representative contingency via the one-hour trajectory of power flow on each line after the loss of the largest generator (G-101) in the upper area, which serves as Bl, the initial contingency in the template DET in Figure 6.8. We see that line
L401 is the most loaded line for the entire system. Figure 6.10 shows the time domain simulation results of the flow on Line L401 with and without the first and second actions

127
(B3 and B5 in Figure 6.8) applied. The effectiveness of the first redispatch only holds until time 1100s. After that, load increase causes the flow on that line to exceed 100% again. To prevent further loading, an emergency load-shedding scheme is identified and executed to prevent circuit loadings from exceeding their ratings. The initiating contingency and system trajectory with and without actions, as shown in Figure 6.8, are mapped to the DET branches and nodes shown in Figure 6.8.
Since the DET engine has the capability of slow dynamic simulation, we can also observe the voltage variation in the test system. We find that, even though the DET engine for the test system is designed to solve the overload problems only, the action taken by the
DET engine solves the voltage problems as well. Of the 394 stable, but unacceptable contingencies, 29 exhibited low voltages in the southern part of the system that were corrected by either the first (redispatch) or second (load interruption) actions taken.
Table 6.3 Voltage problem summary by identified contingency for test system
Contingency
Type
Collapse immediately
No Voltage
Problem
Corrected by first action
FG
SB
IT
0
0
10
65
114
186
0
0
16
Corrected by second action
1
2
10
Figure 6.11 illustrates a representative contingency, resulting in overloading and low voltage, via the flow on the most severely overloaded line after loss of lines LI06 followed by the inadvertent tripping of LI 16. Figure 12 shows the voltage of the most severely depressed bus following the same contingency. The contingency, decisions, and system behaviors of Figure 6.11 and Figure 6.13 are mapped to the branches and nodes of the DET in Figure 6.8. The voltage collapses after 1800 seconds (point E in Figure 6.13) if the operator does not take any action. Following the system reconfiguration (a redispatch) at 1 minute (point A in Figure 6.13), the system behaves well until point D, where a low voltage problem shows up. If the secondary action at point B is applied, the system will avoid both the overloading and the voltage problems.

128
Loading (%)
300% ?—
250%
200%
L401 Loading
L116 Loading
150%
100%
50%
0%
L104 Loading
500 1000 1500 2000 2500 3000 3500 4000 time (s)
Figure 6.10 Branch loading after lost of the largest generator
-e— loading w/o any action
-a— loading after reconfiguration
-A— loading with emergency loading shedding scheme applied
1 minute apply svst am reconfiq uration relieve loa ding (B3 in
BB-œe
18 minul 9, apply mergency sheddi
B5 in Fig. 7 minute, loss of the larg
(3101 in Fig. 7)
0 500 1000 1500 2000 time/second
2500 3000 3500
Figure 6.11 Line flow response after the lost of the largest generator
4000

129
350%
—B-prim; iry line load ng profile
300%
'250%
—e-loadi ng after first correction i . 1 ig after sec mdary com ictioni
At fmir ute, apply
200%
"O
CD "O ro
_o m o
150T4
/
100°/
S o
50%
At 0 th mi lute, Lines At 16 th r linute, applv
'
L116 an L106 are
Emerge icy load she idding tripped.( B5 in Fig.7 (B5 in F g.7)
• on aoteg ea
500 1000 1500 2000 time/second
2500 3000 3500
Figure 6.12 The DET scheme for the tripping of lines LI 06 & LI 16
(most severely overloaded circuit)
4000
^^guradontoreBeve gyskm emergency load loading (B3 in Fig. 7) shedding (B5 in Fig. 7)
Voltage normal with Bl,
B3 and B5. (S5 in Fig. 7)
H-À : a- 0.8
-tokwlta|e ^i|)bteni-i- » with reoonQgumdon only
(S4 in Fig. 7)
« 0 . 7 ro
"o
>
0.6 g 0.5
LiM (Bl in Fig, 7)
-I V^t^cWlap$&&#bct# iaWanj
0.4
0 500 1000 1500 2000 time(second)
2500 3000 3500
Figure 6.13 Voltage response after the lost of the largest generator
4000

130
This work is the first to propose the use of c/wsfer probability model to predict the longterm tendency of cascading in power systems. The proposed model explains the distribution of existing observed statistics very well. It is also the first to propose the use of the affinity index to evaluate the likelihood of multiple contingencies in power systems. The model is compared again the frequently discussed Power Law model. We find the cluster model is superior to Power Law model. This model can also give the conditional probability of next transmission outage given the number of lines already lost.
A systematic way is proposed to identify power system initiating contingencies (including higher-order) for operational use in the third and fourth chapters of this dissertation. It is the first to use B-matrix to represent the connective of functional groups (also call protection control groups). It is the first to give the formula in matrix form to evaluate the probabilities of fault plus stuck breaker contingencies. The work extends the conventional contingency list by including a subset of high-order contingencies, which is identified through topology processing.
This work is the first to propose the use of dynamic event tree as an operational defense plan to cascading events in power systems. The DET can provide guidance for system operator to respond rapidly to the high-risk contingencies. The idea significantly improves the readiness of system operators to possible cascadings.
We tested our DET concept on a small system, which proved the effectiveness of DET as a decision support tool for control room operator. The DET engine we designed is seamlessly integrated with system real time information such as topology and maintenance scheduling.
Whenever the DET engine sees an overloading problem, it can suspend the on-going dynamic simulation process and does a static optimization (linear programming) to search for

131 the redispatch to relieve the overloading. The contribution of this work can be summarized as the following bullets
4- Propose a new and more accurate probability model for higher-order contingencies compared with Power Law model;
-4» Propose a systematic approach to strategically select contingencies using system real-time topology information;
V The method to selection contingency provides algorithm to calculate event probability as well;
Designed a long-term dynamic simulation tool that
- Integrates with system topology data in EMS and
- Performs static optimization in a search for operator decision;
Proposed the use of the dynamic event tree (DET) to model and store possible cascading sequences;
The DET combined with the higher-order contingency selection provides operators with guidance and decision support in regard to high-order contingencies.
This dissertation addresses the rare events of power systems comprehensively. It proposes new model to explain the propagation of cascading events, investigated the original of huge black-out, and most important proposes a possible solution to cascading events. Most of this work was completed well before the August 14 of 2003, when the northeastern part of
United States was stuck by the largest blackout in history. The US blackout was followed by a sequence of similar events in four European countries: Sweden, Denmark, Italy, and the
United Kingdom within a few months. These rare events remain latent as if they will never happen. The general public tends to be dumb when huge blackouts do not happen for a long time. When they happen, people feel alarmed and tend to overact. Actually, it is inappropriate to compare these rare events (or so-called catastrophic events) to nature disasters such as strong earthquakes and prehistoric biological distinctions. Unlike the natural systems such the earth and animal fauna, power systems are completely man-made. If

132 engineers can design power systems from scratch, they should be able to prevent those cascading events caused by the internal defect in power systems.
In recent years, we see much advancement in power system analysis and other monitoring tools, however there has been a delay in their application in online security assessment and decision-making. It is possible that some of the recent events could have been avoided if some more advanced techniques were available [8].
I summarized below my past and future work in case I have a chance to extend my work or other peoples are interested in continuing my work.
Task 1 : Concept of rare event system and its application in evaluating the probability of power system contingencies (completed)
V Task 2: Developing a general probability model for rare events in power systems
(completed)
-4» Task 3: Find the possible application of our ideal probability models for rare event prevention (not done yet)
Task 4: Developing the algorithm for identification of topology related contingencies (completed)
Task 5: Implementing the algorithm to identify topology related contingencies
(completed)
Task 6: Developing the concept of dynamic event tree (completed)
V Task 7: Developing algorithms for the generation of DET (partially completed)
Task 8: Developing viable scheme for the application of DET in power system control center, (not done yet)

AREA 1 / AREA 2
LOAD-14- ! 4 LOAD-2
Figure A.l Ontario hydro 4-generator system with test substation added
Table A. 1 Bus sections and breaker connection data
BKNo. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
FR-BS 1 1 16 8 2 18 5 5 5 20 11 6 6 22 4 4 24 3
TO-BS 7 15 2 2 17 5 9 10 19 6 6 12 21 4 13 23 3 14
No.
1
2
3
4
Table A.2 Load and shunt data
BS No.
9
12
10
11
G(p.u.)
15.5684
13.9426
0
0
B(p.u.)
-1 .0103
-0.9966
2.235
2.58
No
1
2
3
4
5 r
0.0025
0.001
0.022
0.001
0.0025
Table A.3 Line data
X
B
0.025
0.01
0.22
0.01
0.025
0
0
0
0
0
FR-BS
15
17
19
21
23
TO-BS
16
18
20
22
24

134
Name
No
Table A.4 Generator data
L-1 L-2 L-3
1 2 3
U-1
4
Bus Section
K
K
K
K
T do
7 8
45 45 45 45 D
X,
X
0.2 0.2 0.2 0.2 ,
0.189 0.189 0.189 0.189
N/A N/A N/A N/A
N/A N/A N/A
N/A
N/A
N/A
N/A
N/A
N/A
14
N/A
N/A
N/A
13
N/A
N/A
N/A
N/A
8 8 8 8
0.4 0.4 0.4 Ko
8
0.4
H 58.5
T,
58.5
0.4
8
0.4
58.5
8
0.4
58.5
8
0.4
58.5
58.5 58.5 58.5
R mBase
0.0025
100
0.0025
100
0.0025
100
0.0025
100

135
6.302
G202
SUS-202
LOADxOl
L103
L1Q2
(
G10l
HK©—
L207
LOÂD2Q3
L2Î1
LOAD1Q2
T401 BUS-401
BUS-201
Figure B. 1 One line diagram of a DET test system

136
No fb to name No fb
1 2
2 2
3 5
4 5
5 6
6 7
7 8
8 8
3
4
3
6
4
3
7
BUS-7
8US-7
BUS-7
BUS-7
BUS-7
BUS-7
BUS-7
33 46
34 51
35 50
36
37
49
46
38 53
39 47
40 37 4 BUS-7
9 9
10 9
11 10
3
10
4
BUS-7
BUS-7
BUS-7
41 37
42 38
43 39
12 3 11 BUS-7
13 11 12
44 39
BUS-7 45 40
14 12 4 BUS-7 46 41
15 13 14 BUS-8 47 42
16 14 15 BUS-8 48 42
17 15 16 BUS-8
18 16 17 BUS-8
49 43
50 43
19 13 18 BUS-8 51 44
20 65 54 BUS-8 52 45
21 17 54 BUS-8 53 45
22 20 21 BUS-9 54 34
23 20 19 BUS-9 55 34
24 19 22 BUS-9 56 33
25 21 23 BUS-9 57 29
26 23 24 BUS-9 58 55
27 24 22 BUS-9 59 31
28 25 21 BUS-9 60 30
29 25 26 BUS-9 61 56
30 26 22 BUS-9 62 57
31 27 21 BUS-9 65 53
32 22 27 BUS-9 66 63
Table C .l Bus section and breaker data to name No fb to
51
50
BUS-5
BUS-5
67
68
18
66
65
67
49
48
62
47
BUS-5 101 102
BUS-5 102 102
BUS-5 103
BUS-5
105
104 105
103
104
103
106
48
35
38
BUS-5 105 106
BUS-4 106 107
BUS-4 107 108
BUS-4 108 108
104
103
107
36 104
35 BUS-4 109 109
40 BUS-4 110 109
103
110
36 BUS-4 111 110 104
35 BUS-4 112 103 111
41 BUS-4 113 111 112
36 BUS-4 114 112 104
35 BUS-4 115 113
36 BUS-4 116 114
114
115
35 BUS-4 117 115 116
44 BUS-4 118 116
36 BUS-4 119 113
29 BUS-6 120 118
33 BUS-6 121 117
55 BUS-6 122 120
30 BUS-6 123 120
56 BUS-6 124 119
32 BUS-6 125 121
31 BUS-6 126 123
32 BUS-6 127 124
117
118
154
154
121
119
122
123
124
122
58 BUS-6 128 125
62 BUS-5 129 125
64 BUS-5 130 126
121
126
122 name No fb to name
BUS-8 131 127 121 BUS-9
BUS-8 132 122 127 BUS-9
BUS-7 133 146 151 BUS-5
BUS-7 134 151 150 BUS-5
BUS-7 135 150 149
BUS-7 136 149
BUS-5
148 BUS-5
BUS-7 137 146 153 BUS-5
BUS-7 138 153 147
BUS-7 139 147 148
BUS-5
BUS-7 144 139 140
BUS-5
BUS-7 140 137 135 BUS-4
BUS-7 141 137 138 BUS-4
BUS-7 142 138 136 BUS-4
BUS-7 143 139 135 BUS-4
BUS-4
BUS-7 145 140 136
BUS-7 146 141
BUS-4
135 BUS-4
BUS-8 147 142 141 BUS-4
BUS-8 148 142 136 BUS-4
BUS-8 149 143 135 BUS-4
BUS-8 150 143 136 BUS-4
BUS-8 151 144 135 BUS-4
BUS-8 152 145 144 BUS-4
BUS-8 153 145 136 BUS-4
BUS-9 154 134 129 BUS-6
BUS-9 155 134 133 BUS-6
BUS-9 156 133 155 BUS-6
BUS-9 157 129 130 BUS-6
BUS-9 158 155 132 BUS-6
BUS-9 159 131 132 BUS-6
BUS-9 160 130 131 BUS-6
BUS-9
BUS-9
-
-

137
Name
G001-STEPUP
G002-5TEPUP
G003-STEPUP
G101-STEPUP
G102-STEPUP
G103-STEPUP
TAP-1
TAP-2
TAP-3
Name
No
Bus Section
D
L-1
1
52
10
0.14
Table C.2 Generator parameters
L-2 L-3 U-1
2
1
10
0.89
3
28
10
1.31
101
152
10
0.14
U-2
102
101
10
0.89
0.09 0.86 1.25 0.09 0.86 1.25 x,
0.03 0.05 0.07 0.03 0.05 0.07
K
0.06 0.11 0.18 0.06 0.11 0.18
K
0.09 0.02 0.25 0.09 0.02 0.25
K
0.02 0.2 0.2 0.02 0.2 0.2
K
0.02 0.2 0.2 0.02 0.2 0.2
T do 8.96 6 5.89 8.96 6 5.89
K.
0.01 0.535 0.6 0.01 0.535 0.6
Tl
0.01 0.535 0.6 0.01 0.535 0.6
K,
0.01 0.535 0.6 0.01 0.535 0.6
H 23.64 6.4 3.01 23.64 6.4 3.01
P
0 0 0 0 0 0
163 109 248 163 109 248
U-3
103
128
10
1.31
1
2
3
101
102
103
4
6
7
No
Table C.3 Transformer parameters
FR-BS TO-BS r X
43
1
27
143
101
127
56
62
65
52
2
28
152
102
128
57
63
66
0
0
0
0
0
0
0.001
0.001
0.001
0.0576
0.0625
0.0586
0.0576
0.0625
0.0586
0.04
0.04
0.04 ratio
1
1
1
1
1
1
1
1
1 rating
500
500
500
500
500
500
500
500
500

138
1109
1110
L111
L112
L113
L114
L115
L116
L117
L102
L103
L104
L105
L106
L107
L108
L118
L301
L302
L401
NAME
L1
L2
L3
14
L5
L6
L7
L8
L9
L10
L11
L12
L13
L14
L15
L16
L17
L18
L101
18
101
102
103
104
105
106
107
108
4
5
6
7
8
No
1
2
3
14
15
16
17
9
10
11
12
13
109
110
111
112
113
114
115
116
117
118
301
302
401
113
118
154
130
131
142
141
139
153
147
148
111
112
110
132
140
138
137
105
106
144
F-BUS
42
41
39
53
47
48
11
12
10
13
18
54
30
31
32
40
38
37
Table C.4 Line parameters for the test system
R
0.051
0.051
0.03
0.03
0.03
0.051
0.051
0.051
0.096
0.096
0.096
0.0255
0.0255
0.051
0.096
0.096
0.096
0.0255
0.0255
0.0255
0.0357
0.0357
0.0357
0.117
0.117
0.117
0.0255
0.0357
0.0357
0.0357
0.117
0.117
0.117
0.03
003
0.03
0.03
0.03
0.03
X
0.276
0 276
0.276
0.483
0.483
0.483
0.216
0.216
0.216
0.3024
0.3024
0.3024
0.51
0.51
051
0.255
0.216
0.216
0.3024
0.3024
0.3024
0.51
0.51
0.51
0.255
0.255
0.255
0.16
0.16
0.16
0.255
0.255
0.276
0.276
0.276
0.483
0.483
0.483
0.216
T-BUS
33
34
29
8
7
19
24
23
25
26
51
50
9
14
15
16
20
49
133
134
129
108
107
109
114
115
116
120
151
150
149
64
67
58
119
124
123
125
126
B
0.052667
0.052667
0.052667
0.119333
0.058667
0.058667
0.058667
0.052667
0.052667
0.052667
0.102
0.102
0.102
0.049667
0.049667
0.049667
0.069667
0.069667
0.102
0.102
0.102
0.049667
0.049667
0.049667
0.069667
0.069667
0.069667
0.119333
0.119333
0.069667
0.119333
0.119333
0.119333
0.058667
0.058667
0.058667
0.05
0.05
0.05
30.69879
30.69879
30.69879
17.41327
17.41327
17.41327
11.33927
11.33927
11.33927
33.05252
33.05252
33.05252
25.35086
25.35086
25.35086
17.55411
17.55411
17.55411
27.22736
27.22736
27.22736
20.55661
20.55661
20.55661
127.4453
29.50849
40.93759
RATING
20.87184
20.87184
20.87184
40.60418
40.60418
40.60418
45.35213
45.35213
45.35213
13.94768
13.94768
13.94768

139
BUS
1
2
3
101
102
103
Table C.5 Load data
NAME BS-No P(MW)
UPPER -1
UPPER-2
UPPER-3
LOWER-1
LOWER-2
LOWER-3
46
55
17
146
155
117
125
90
100
125
90
100
P(MVAR)
50
30
35
50
30
35

Figure D.l IEEE RTS-24 bus test system substation diagram

141
[1] NERC Planning Standard, "http://www.nerc.com/-filez/pss-psg.html". (Date accessed: September 1, 2003).
[2] CIGRE, task Force 38.02.19, "System protection schemes in power networks,"
CIGRE SCTF 38.02.19, 2000.
[3] U.G. Knight, "Power System in Emergencies from Contingency Planning to Crisis
Management," John Wiley & Sons Ltd, 2001.
[4] NERC (North American Reliability Council) Disturbance Analysis Working Group
Database, "http://www.nerc.com/-dawg/database.html," 1984-2001. (Date accessed:
Sept. 1,2003).
[5] PSERC (Power Systems Engineering Research Center), "http://www.pserc.wisc.edu,"
1984-2001. (Date accessed: Sept. 1,2003).
[6] Joseph C. Swidler; David S. Black; Charles, R. Ross; Lawrence J. O'Connor, Jr.,
Report to the President By the Federal Power Commission On the Power Failure in the Northeastern United States and the Province Of Ontario on November 9-10,1965.
[7] Corwin, Jane L. and William T. Miles, "Impact Assessment of the 1977 New York
City Blackout." Palo Alto: Systems Control Inc., Prepared for Lester H. Fink, Div. of
Electric Energy Systems, U.S. Department of Energy, July 1978.
[8] Taylor C.W., Power system voltage stability, McGraw-Hill, New York, USA, 1994,
273 p.
[9] A. Kurita, T. Sakurai, "The power system failure on July 23, 1987 in Tokyo," Proc.
27th conf. on Decision and Control, Austin, Texas, pp. 2093-2097,1988.
[10] X. Vieira Filho, J.J.G. Couri, J.M. Steinberger, E. Salgado, L.A.S. Pilotto, N. Martins,
A.R.C. Carvalho, M. Roitman, A. Bianco, H.J. Chipp, P. Gomes, "The March 11th
1999 Blackout: Short-Term Measures to Improve System Security and Overview of the Reports Prepared by the International Experts," CIGRÉ Large Disturbance
Workshop, Paris, France, August, 2000.

142
[11] U.S.-Canada Power System Outage Task Force, Final Report on the August 14, 2003
Blackout in the United States and Canada: Causes and Recommendations, April 2004
[12] Office of Gas and Electricity Markets, Preliminary Report into the Recent Electricity
Transmission Faults Affecting South London and East Birmingham, UK, September
2003.
[13] ElkraA System, Power failure in Eastern Denmark and Southern Sweden on 23
September 2003, Final report on the course of events, Nov. 2003.
[14] Svenska KraAnat, The black-out in southern Sweden and eastern Denmark, 23
September, 2003 Preliminary report, Oct. 2003.
[15] Union for the Co-ordination of Transmission of Electricity, Interim Report of the
Investigation Committee on the 28 September 2003 Blackout in Italy, UCTE Report,
27 October, 2003.
[16] Mohammad Modarres, Mark Kaminskiy, Vasiliy Krivtsov, "Reliability Engineering and Risk Analysis," Marcel Dekker, Inc., 1999.
[17] Amljot Hoyland, Marvin Rausand, "System Reliability Theory Models and Statistical
Methods," John Wiley & Sons, Inc., 1994.
[18] W.A. Thompson, Jr., "Point Process Models with Applications to Safety and
Reliability," Chapman and Hall, 1988.
[19] Probabilistic Methods Work Group, WSCC Reliability Subcommittee, "Probabilistic
Based Reliability Criteria Phase I: Event Probability Development and
Implementation Plan," June 25, 1998.
[20] A. O. Ekwue, "A review of automatic contingency selection algorithms for online security analysis," The Third International Conference on Power System Monitoring and Control, pp 152-155, June 26-28,1991.
[21] Caglar, R.; Ozdemir, A.; Mekic, F.; "Contingency selection based on real power transmission losses," International Conference on Electric Power Engineering,
PowerTech Budapest 99, pp 117-117, Aug. 29-Sept. 2,1999.
[22] A. Mohamed, G.B. Jasmon, "Voltage contingency selection technique for security assessment," IEE proceedings, vol. 136, Pt.C, No.l, January 1989, pp 24-28

143
[23] McCalley, J.D.; Fouad, A.A.; Vittal, V.; Irizarry-Rivera, A.A.; Agrawal, B.L.;
Farmer, R.G., "A risk-based security index for determining operating limits in stability-limited electric power systems," IEEE Transactions on Power Systems, Vol.
12, Issue 3, pp 1210-1219, Aug. 1997.
[24] McCalley, J.D.; Vittal, V.; Wan, H.; Dai, Y.; Abi-Samra, N., "Voltage risk assessment," Proceedings of IEEE Power Engineering Society Summer Meeting, Vol. l,pp: 179-184,1999.
[25] Youjie Dai, J.D McCalley, N. Abi-Samra, V. Vittal, "Annual risk assessment for overload security," IEEE Transactions on Power Systems, Vol. 16, Issue 4, pp 616-
623, Nov. 2001.
[26] Weihui Fu; McCalley, J.D.; Vittal, V., "Risk assessment for transformer loading,"
IEEE Transactions on Power Systems, Vol. 16, Issue: 3, pp 346-353, Aug. 2001.
[27] Weihui Fu; McCalley, J.D., "Risk based optimal power flow," Power Tech
Proceedings, 2001 IEEE Porto, Vol. 3, pp 238-243,2001.
[28] Hua Wan; McCalley, J.D.; Vittal, V., "Risk based voltage security assessment," IEEE
Transactions on Power Systems, Vol. 15, Issue 4, pp 1247-1254, Nov. 2000.
[29] McCalley, J.D.; Weihui Fu, "Reliability of special protection systems," IEEE
Transactions on Power Systems, Vol. 14, Issue 4, pp 1400-1406, Nov. 1999.
[30] Wan, H.; McCalley, J.D.; Vittal, V., "Increasing thermal rating by risk analysis,"
IEEE Transactions on Power Systems, Vol. 14, Issue 3, pp 815-828, Aug. 1999.
[31] Van Acker, V.; McCalley, J.D.; Vittal, V.; Pecas Lopes, J.A., "Risk-based transient stability assessment," International Conference on Electric Power Engineering,
PowerTech Budapest 99, pp 235,1999.
[32] Vittal, V.; McCalley, J.D.; Van Acker, V.; Fu, W.; Abi-Samra, N., "Transient instability risk assessment," IEEE Power Engineering Society Summer Meeting, Vol. l,pp 206-211,1999.
[33] McCalley, J.D.; Vittal, V.; Abi-Samra, N., "An overview of risk based security assessment," IEEE Power Engineering Society Summer Meeting, Vol. 1 ,pp 173-178,
1999.

144
[34] J. McCalley, "Decision-Making Techniques for Security-Constrained Power
Systems," Final report for EPRI project W0721201, Dec., 2000.
[35] J McCalley and V. Vittal, "On-Line Risk-Based Security Assessment," Final Report,
EPRI Project W0663101, number 1000411, Nov., 2000.
[36] J. McCalley, V. Vittal, and M. Ni, "On-line Risk-Based Security Assessment," EPRI
Report 1000411, Nov. 2000.
[37] R. N. Allan, A. N. Adraktas, "Terminal effects and protection system failures in composite system reliability evaluation," IEEE Transactions on Power Apparatus and
Systems, Vol. PAS-101, No. 12, pp 4557-4562, Dec. 1982.
[38] R. Billinton, T. K. P. Medicherla, "Station originated multiple outages in the reliability analysis of a composite and transmission system," IEEE Transactions on
Power Apparatus and Systems, Vol. PAS-100, No. 8, pp 3870-3878, Dec. 1982.
[39] R. Billinton, P. K. Vohra, Sudhir Kumar, "Effect of Station originated outages in a composite system - adequate evaluation of the IEEE reliability test system," IEEE
Transactions on Power Apparatus and Systems, Vol. PAS-104, No. 10, pp 2649-2656,
Oct. 1985.
[40] Adler, R.B.; Daniel, S.L., Jr.; Heising, C.R.; Lauby, M.G.; Ludorf, R.P.; White, T.S.;
"An IEEE survey of US and Canadian overhead transmission outages at 230 kV and above," IEEE Transactions on Power Delivery, Vol. 9, Issue 1, pp 21 -39, Jan. 1994.
[41] P. Bak, C. Tang, K. Wiesenfeld, "Self-Organized Criticality: An Explanation of 1/f
Noise," Phys. Rev. Lett., Vol. 59, pp 381-384,1987.
[42] Dobson, I.; Chen, J.; Thorp, J.S.; Carreras, B.A.; Newman, D.E.; "Examining criticality of blackouts in power system models with cascading events," Proceedings of the 35th Annual Hawaii International Conference on System Sciences, 2002.
HICSS, pp 803-812, January 7-10,2002.
[43] Carreras, B.A.; Newman, D.E.; Dobson, I.; Poole, A.B. "Initial evidence for selforganized criticality in electric power system blackouts," Proceedings of the 33rd
Annual Hawaii International Conference on System Sciences, pp 1411-1416,2000.
[44] Qiming Chen, James D. McCalley, "Identification of High Order Initiating Events for
Power System Security Assessment Considering Protection System Failure,"

145
Proceedings of North American Power Symposium (NAPS) 2001, pp 303-308,
October 15-16,2001.
[45] Michael Falk, Jurg Husler, Rolf-Dieter Reiss, "Laws of small numbers: Extremes and rare events," Birkhauser Verlag, P.O. Box 133, CH-4010 Basel, Switzerland, pp 4-4,
1994.
[46] Per Bak, "How Nature Works," Springer-Verlag New York, Inc., 1996.
[47] Course Bio340 lecture note, Central Michigan University, Website: ,
"http://www.cst.cmich.edu/users/swanslbj/Ecology/Galls.pdf' (Date accessed: April
11,2004).
[48] Carson W. Taylor, "Improving grid behavior," IEEE Spectrum, Vol. 36, Issue: 6, pp40-45, Jun. 1999.
[49] The reliability test system task force of the application of probability methods sub committee, "IEEE reliability test system," IEEE Transactions on Power Apparatus and Systems, Vol. PAS-98, pp 2047-2045, Nov./Dec. 1979.
[50] The reliability test system task force of the application of probability methods sub committee, "The IEEE reliability test system - 1996," IEEE Transactions on Power
Systems, Vol. 14, No. 3, pp 1010-1018, Aug. 1999.
[51] George Casella, Roger L. Berger, "Statistical Inference," the Wadsworth Group,
2002.
[52] (Xiru Chen), "Introduction to Mathematical Statistics",
[53]
(Science Publishing House), China, 1981.
(Fengshi Ma); M Ê.# (Liangcai He); A % 4$ (Mingshu Yu); fS A#
(Jincheng Fan), "Applied Mathematical Statistics",
China, 1989.
[54] C.C. Gotlieb, L.R. Gotlieb, "Data Types and Structures," Prentice-Hall. Inc., 1978.
[55] (Xiumu Li), "Introduction to Graph Theory",
A
(Publishing House of Huazhong Institute of Technology), China, 1986.
[56] Harary, F., Graph Theory. Reading, MA: Addison-Wesley, 1994.

146
[57] (Xiaolin Zhuo);
"Discrete Mathematics",
(Weijian Li); (Yongcai Liu), (A###)
(Shanghai Science and
Technology Reference Publishing House ), 1982.
[58] A. Phadke, "Security Mapping and Reliability Index Evaluation, Task IV: Integrating
Protection System Influence on the Development of JV-& Measures," EPRI report,
Feb.2001.
[59] A. Monticelli, "State estimation in electrical power system, a generalized approach,"
Kluwer Academic Publishers, 1999.
[60] J. Lewis Blackburn, "Protective relaying, principles and applications," Marcel
Dekker, Inc., 1987.
[61] #### (Songdi Qian, etc.), "Operations Research",
(Tsinhua University Publishing House), China, 1990.
[62] Allen J. Wood, Bruce F. Wollenberg, "Power generation, operation and control,"
John Wiley & Sons, Inc., 1996.
[63] Qiming Chen, Kun Zhu, and McCalley, J. D., "Dynamic decision-event trees for rapid response to unfolding events in bulk transmission systems," 2001 IEEE Porto
PowerTech Proceedings, Porto, Portugal, Vol. 2, SEP 2001.
[64] J. L. Sancha; M. L. Llorens, J. M. Moreno, B. Meyer, J. F. Vemotte, W. W Price, J. J.
Sanchez-Gasca, "Application of long-term simulation programs for analysis of system islanding," IEEE Transactions on Power Systems, Vol. 12, Issue 1, pp 189-197, Feb.
1997.
[65] A. Mendola, "Accident Sequence Dynamic Simulation versus Event Trees,"
Reliability Engineering and System Safety, Vol. 22, pp 3-25, 1988.
[66] C. Acosta, N. Siu, "Dynamic event trees in accident sequence analysis: application to steam generator tube rupture," Reliability Engineering and System Safety, Vol. 41, pp
135-154,1993.
[67] Jun Zhang; Jian Pu; McCalley, J.D.; Stem, H.; Gallus, W.A., Jr.; "A Bayesian approach for short-term transmission line thermal overload risk assessment" IEEE
Transactions on Power Delivery, Volume: 17, Issue: 3, pp 770-778, July 2002

147
[68] P. Kundur; edited by Neal J. Balu, "Power system stability and control," Mark G.
Lauby, McGraw-Hill, 1994.
[69] Paul M. Anderson, A. A. Fouad, Power system control and stability, the Institute of
Electrical and Electronic Engineers, Inc., 1994.
[70] Voumas, C D.; Manos, G.A.; Sauer, P.W.; Pai, M.A.; "Effect of overexcitation limiters on power system long-term modeling," IEEE Transactions on Energy
Conversion, Vol. 14, Issue 4, pp 1529-1536, Dec. 1999.
[71] Astic, J.Y.; Bihain, A.; Jerosolimski, M.; "The mixed Adams-BDF variable step size algorithm to simulate transient and long-term phenomena in power systems," IEEE
Transactions on Power Systems, Vol. 9, Issue 2, pp 929-935, May 1994.
[72] "Power system dynamic analysis phase I," Boeing Computer Services, EEPRI EL-
484 Project 670-1, Final report, July 1977.
[73] Sanchez-Gasca, J.J.; D'Aquila, R.; Paserba, J.J.; Price, W.W.; Klapper, D.B.; Hu, I-
P.; "Extended-term dynamic simulation using variable time step integration," IEEE
Computer Applications in Power, Vol. 6, Issue 4, pp 23-28, Oct. 1993.
[74] Sanchez-Gasca, J.J.; D'Aquila, R.; Price, W.W.; Paserba, J.J.; "Variable time step, implicit integration for extended-term power system dynamic simulation," IEEE
Conference Proceedings of Power Industry Computer Application Conference, pp
183-189, May 7-12,1995.
[75] Brian Stott, "Power system dynamic response calculations," Proceeding of IEEE, Vol.
67, No.2, pp. 219-241, Feb. 1979.
[76] (Qingyang Li); (Nengcao Wang); jC (Dayi Yi),
"Numerical Analysis", (Publishing House of Huazhong Institute of Technology), China, 1982.
[77] loannis A. Papazoglou, "Math foundation of event tree," Reliability Engineering and
System Safety, Vol. 61, pp 169-183,1998.
[78] Fried, R.; Cherkaoui, R.S.; Enz, C.C.; Germond, A.; Vittoz, E.A.; "Analog VLSI solution to the stability study of power networks," Proceedings of the Third IEEE
International Conference on Electronics, Circuits, and Systems, 1996. ICECS '96,
Vol.1, pp 239-242, Oct. 1996.

148
Fried, R.; Cherkaoui, R.S.; Enz, C.C.; Germond, A.; Vittoz, E.A.; "Approaches for analog VLSI simulation of the transient stability of large power networks," IEEE
Transactions on Circuits and Systems I: Fundamental Theory and Applications, ,Vol.
46, Issue: 10, pp1249-1263, Oct. 1999.

149
I would like to express my gratitude to my advisor, James D. McCalley, for his support, patience, understanding, and encouragement throughout my doctorate studies in Iowa State
University. I am fortunate to have an academic advisor that always finds the time to discuss the difficulties I encountered during my research. His high-level, technical, and editorial advice was essential to the completion of this work. He has taught me a number of invaluable lessons and insights on conducting academic research in general.
I am also grateful to Dr. Vittal Vijay for the many seminars that he presided. They greatly inspired my thinking on cascading events in power systems. My thanks also goes to Sunder
Sethuraman, the member of my major committee, for taking time to discuss with me the interesting topics of rare events. The friendship of Wenzheng Qiu is also greatly appreciated for her help in the validation of my long-term simulation program. I am also grateful to my colleagues Zhong Zhang, Yong Jiang, and Haifeng Liu for their help when I was away from
Iowa State Univeristy.
Last, but not least, I would like to thank my wife Rong Li for her understanding and love.
My parents, Jiaqing Chen and Yunmei Zhang, receive my deepest gratitude and love for their dedication and the many years of altruistic support for my education that provided a solid ground for this work.
Part of this work was sponsored by EPRI contract W0663101 (the Electric Power
Research Institute) and the Complex Interactive Systems/Networks initiative contract
W08333-01 (the Electric Power Research Institute and the Department of Defense).